CVE-2016-9456 (published 2017-03-28T02:59Z)

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/revive-adserver/revive-adserver
commit_details: repo_url: https://github.com/revive-adserver/revive-adserver
author: Matteo Beccati
author_date: 2016-01-28 10:54:36+01:00
msg: Fix other CSRF issues

Cross-Site Request Forgery (CSRF)
---------------------------------

Following a number of CSRF reports, the Revive Team has conducted a security
audit of the admin interface scripts in order to identify and fix other
potential CSRF vulnerabilities.

The effort led to fixing 20+ such issues: please see the commit for the full
list of files affected.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
repository: repo_url: https://github.com/revive-adserver/revive-adserver
repo_name: revive-adserver/revive-adserver
description: The world's most popular free, open source ad serving system. You can download the latest release at:
repo_language: PHP
owner: revive-adserver
file_changes: filename: Template.php
change_type: ModificationType.MODIFY
diff: @@ -119,6 +119,8 @@ class OA_Admin_Template extends Smarty
          */
         $this->register_function('rv_add_session_token', array('OA_Admin_Template', '_add_session_token'));
 
+        // Also assign a template variable for other usages
+        $this->assign("csrfToken", phpAds_SessionGetToken());
     }
 
     /**

programming_language: PHP
filename: TrackerAppend.php
change_type: ModificationType.MODIFY
diff: @@ -46,6 +46,7 @@ class MAX_Admin_Inventory_TrackerAppend
     {
         $this->_useDefaultDal();
 
+        $this->csrf_token    = phpAds_SessionGetToken();
         $this->advertiser_id = MAX_getValue('clientid', 0);
         $this->tracker_id    = MAX_getValue('trackerid', 0);
         $this->assetPath 	 = OX::assetPath();

programming_language: PHP
filename: TrackerAppend.html
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@
 function MMM_trackerAction(action, id)
 {
     var f = document.getElementById('trackerAppendForm');
-    
+
     f.t_action.value = action;
     f.t_id.value = id;
     f.submit();
@@ -26,6 +26,7 @@ function MMM_trackerAction(action, id)
 <span class='tab-s'>You have unsaved changes on this page, make sure you press &quot;Save Changes&quot; when finished</span><br>
 </div>
 <form id="trackerAppendForm" class="section" method="post">
+    <input type="hidden" name="token" value="{csrf_token}" />
     <input type="hidden" name="clientid" value="{advertiser_id}" />
     <input type="hidden" name="trackerid" value="{tracker_id}" />
     <input type="hidden" name="t_action" />

programming_language: HTML
filename: html.php
change_type: ModificationType.MODIFY
diff: @@ -1147,6 +1147,7 @@ function MAX_displayAcls($acls, $aParams)
     $conf = $GLOBALS['_MAX']['CONF'];
 
     echo "<form action='{$page}' method='post'>";
+    echo "<input type='hidden' name='token' value='".urlencode(phpAds_SessionGetToken())."' />";
 
     echo "<label><img src='" . OX::assetPath() . "/images/icon-acl-add.gif' align='absmiddle'>&nbsp;". $GLOBALS['strACLAdd'] .": &nbsp;";
     echo "<select name='type' accesskey='{$GLOBALS['keyAddNew']}' tabindex='".($tabindex++)."'>";
@@ -1689,11 +1690,14 @@ function addAdvertiserPageToolsAndShortcuts($advertiserId)
 function addTrackerPageTools($advertiserId, $trackerId, $aOtherAdvertisers)
 {
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN) || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)) {
+        $token = phpAds_SessionGetToken();
+
         //duplicate
-        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-modify.php?clientid=".$advertiserId."&trackerid=".$trackerId."&duplicate=true&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTrackerDuplicate");
+        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-modify.php?token=".urlencode($token)."&clientid=".$advertiserId."&trackerid=".$trackerId."&duplicate=true&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTrackerDuplicate");
 
         //move to
         $form  = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'tracker-modify.php') . "'>
+            <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
             <input type='hidden' name='trackerid' value='$trackerId'
             <input type='hidden' name='clientid' value='$advertiserId'
             <input type='hidden' name='returnurl' value='tracker-edit.php'>
@@ -1706,7 +1710,7 @@ function addTrackerPageTools($advertiserId, $trackerId, $aOtherAdvertisers)
 
         //delete
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteTracker']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=".$advertiserId."&trackerid=".$trackerId."&returnurl=advertiser-trackers.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "tracker-delete.php?token=".urlencode($token)."&clientid=".$advertiserId."&trackerid=".$trackerId."&returnurl=advertiser-trackers.php"), "iconDelete", null, $deleteConfirm);
         addPageShortcut($GLOBALS['strBackToTrackers'], MAX::constructUrl(MAX_URL_ADMIN, "advertiser-trackers.php?clientid=$advertiserId"), "iconBack");
     }
 }
@@ -1717,13 +1721,17 @@ function addCampaignPageTools($clientid, $campaignid, $aOtherAdvertisers, $aEnti
     global $phpAds_TextDirection;
 
     if (!OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
-        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-modify.php?duplicate=1&clientid=$clientid&campaignid=$campaignid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconCampaignDuplicate");
+
+        $token = phpAds_SessionGetToken();
+
+        addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-modify.php?token=".urlencode($token)."&duplicate=1&clientid=$clientid&campaignid=$campaignid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconCampaignDuplicate");
 
         if (OA_Permission::hasAccessToObject('campaigns', $campaignid, OA_Permission::OPERATION_MOVE)) {
             $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'campaign-modify.php') . "'>
+            <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
             <input type='hidden' name='clientid' value='$clientid'>
             <input type='hidden' name='campaignid' value='$campaignid'>
-            <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
+            <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME'], ENT_QUOTES))."'>
             <select name='newclientid'>";
                 $aOtherAdvertisers = _multiSort($aOtherAdvertisers,'name','advertiser_id');
                 foreach ($aOtherAdvertisers as $aOtherAdvertiser) {
@@ -1740,7 +1748,7 @@ function addCampaignPageTools($clientid, $campaignid, $aOtherAdvertisers, $aEnti
         }
 
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteCampaign']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=$clientid&campaignid=$campaignid&returnurl=advertiser-campaigns.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "campaign-delete.php?token=".urlencode($token)."&clientid=$clientid&campaignid=$campaignid&returnurl=advertiser-campaigns.php"), "iconDelete", null, $deleteConfirm);
     }
 
     //shortcuts
@@ -1761,16 +1769,20 @@ function addCampaignPageTools($clientid, $campaignid, $aOtherAdvertisers, $aEnti
 
 function addBannerPageTools($advertiserId, $campaignId, $bannerId, $aOtherCampaigns, $aOtherBanners, $aEntities)
 {
+    global $phpAds_TextDirection;
+
     if (empty($bannerId)) {
         return;
     }
 
-    global $phpAds_TextDirection;
+    $token = phpAds_SessionGetToken();
+
     //duplicate
-    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "banner-modify.php?duplicate=true&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconBannerDuplicate");
+    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "banner-modify.php?token=".urlencode($token)."&duplicate=true&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconBannerDuplicate");
 
     //move to
     $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'banner-modify.php') . "'>
+    <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
     <input type='hidden' name='clientid' value='$advertiserId'>
     <input type='hidden' name='campaignid' value='$campaignId'>
     <input type='hidden' name='bannerid' value='$bannerId'>
@@ -1795,6 +1807,7 @@ function addBannerPageTools($advertiserId, $campaignId, $bannerId, $aOtherCampai
     //apply to
     if (basename($_SERVER['SCRIPT_NAME']) == 'banner-acl.php') {
         $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'banner-modify.php') . "'>
+        <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
         <input type='hidden' name='clientid' value='$advertiserId'>
         <input type='hidden' name='campaignid' value='$campaignId'>
         <input type='hidden' name='bannerid' value='$bannerId'>
@@ -1815,7 +1828,7 @@ function addBannerPageTools($advertiserId, $campaignId, $bannerId, $aOtherCampai
     //delete
     if (!OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteBanner']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "banner-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=campaign-banners.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "banner-delete.php?token=".urlencode($token)."&clientid=$advertiserId&campaignid=$campaignId&bannerid=$bannerId&returnurl=campaign-banners.php"), "iconDelete", null, $deleteConfirm);
     }
 
     /* Shortcuts */
@@ -1840,6 +1853,9 @@ function addWebsitePageTools($websiteId)
 function addZonePageTools($affiliateid, $zoneid, $aOtherPublishers, $aEntities)
 {
     global $phpAds_TextDirection;
+
+    $token = phpAds_SessionGetToken();
+
     //duplicate
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN)
         || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)
@@ -1851,6 +1867,7 @@ function addZonePageTools($affiliateid, $zoneid, $aOtherPublishers, $aEntities)
     if (OA_Permission::isAccount(OA_ACCOUNT_ADMIN)
         || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)) {
         $form = "<form action='" . MAX::constructUrl(MAX_URL_ADMIN, 'zone-modify.php') . "'>
+        <input type='hidden' name='token' value='".htmlspecialchars($token, ENT_QUOTES)."'>
         <input type='hidden' name='affiliateid' value='$affiliateid'>
         <input type='hidden' name='zoneid' value='$zoneid'>
         <input type='hidden' name='returnurl' value='".htmlspecialchars(basename($_SERVER['SCRIPT_NAME']))."'>
@@ -1872,7 +1889,7 @@ function addZonePageTools($affiliateid, $zoneid, $aOtherPublishers, $aEntities)
        || OA_Permission::isAccount(OA_ACCOUNT_MANAGER)
        || OA_Permission::hasPermission(OA_PERM_ZONE_DELETE)) {
         $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteZone']);
-        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "zone-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=affiliate-zones.php"), "iconDelete", null, $deleteConfirm);
+        addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "zone-delete.php?token=".urlencode($token)."&affiliateid=$affiliateid&zoneid=$zoneid&returnurl=affiliate-zones.php"), "iconDelete", null, $deleteConfirm);
     }
 
     //shortcut
@@ -1890,12 +1907,14 @@ function addChannelPageTools($agencyid, $websiteId, $channelid, $channelType)
         $deleteReturlUrl = MAX::constructUrl(MAX_URL_ADMIN, 'channel-index.php');
     }
 
+    $token = phpAds_SessionGetToken();
+
     //duplicate
-    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "channel-modify.php?duplicate=true&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTargetingChannelDuplicate");
+    addPageLinkTool($GLOBALS["strDuplicate"], MAX::constructUrl(MAX_URL_ADMIN, "channel-modify.php?token=".urlencode($token)."&duplicate=true&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=".urlencode(basename($_SERVER['SCRIPT_NAME']))), "iconTargetingChannelDuplicate");
 
     //delete
     $deleteConfirm = phpAds_DelConfirm($GLOBALS['strConfirmDeleteChannel']);
-    addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "channel-delete.php?token=" . urlencode(phpAds_SessionGetToken()) . "&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=$deleteReturlUrl"), "iconDelete", null, $deleteConfirm);
+    addPageLinkTool($GLOBALS["strDelete"], MAX::constructUrl(MAX_URL_ADMIN, "channel-delete.php?token=".urlencode($token)."&agencyid=$agencyid&affiliateid=$websiteId&channelid=$channelid&returnurl=$deleteReturlUrl"), "iconDelete", null, $deleteConfirm);
 }
 
 

programming_language: PHP
filename: campaign-zone.html
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@
 
 <form id="zoneLinkingForm">
 <div id="campaign-zone" class="new-form">
+  <input id="csrf-token" type="hidden" value="{$csrfToken|escape}" />
   <input id="advertiser-id" type="hidden" value="{$advertiserId}" />
   <input id="campaign-id" type="hidden" value="{$campaignId}" />
 
@@ -213,6 +214,7 @@
     }
 
     var postData = {
+      "token": $("#csrf-token").val(),
       "clientid": $("#advertiser-id").val(),
       "campaignid": $("#campaign-id").val(),
       "text-linked": quickSearchLinked,
@@ -238,6 +240,9 @@
           updatePanel(data, "available");
           updatePanel(data, "linked");
 
+          // Refresh token
+          $("#csrf-token").val(extractPart(data, "value", "token"));
+
 	        $("#linking-status").html(extractPart(data, "info", "result")).stop().show().css("opacity", "1");
 	        if (window.linkingTimout) {
 	          window.linkingTimout.clearTimeout();

programming_language: HTML
filename: banner-modify.php
change_type: ModificationType.MODIFY
diff: @@ -31,13 +31,13 @@ phpAds_registerGlobal('bannerid', 'campaignid', 'clientid', 'returnurl', 'duplic
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_MANAGER);
 
-OA_Permission::checkSessionToken();
-
 /*-------------------------------------------------------*/
 /* Main code                                             */
 /*-------------------------------------------------------*/
 
 if (!empty($bannerid)) {
+    OA_Permission::checkSessionToken();
+
     OA_Permission::enforceAccessToObject('banners', $bannerid);
 
     if (!empty($moveto) && isset($moveto_x)) {

programming_language: PHP
filename: campaign-modify.php
change_type: ModificationType.MODIFY
diff: @@ -43,6 +43,8 @@ else if (!empty($newclientid)) {
 /*-------------------------------------------------------*/
 
 if (!empty($campaignid)) {
+    OA_Permission::checkSessionToken();
+
     if (!empty($duplicate)) {
     	// Duplicate the campaign
     	$doCampaigns = OA_Dal::factoryDO('campaigns');

programming_language: PHP
filename: campaign-zone-link.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ $campaignId = $GLOBALS['campaignid'];
 OA_Permission::enforceAccount ( OA_ACCOUNT_MANAGER );
 OA_Permission::enforceAccessToObject ( 'campaigns', $campaignid );
 
+OA_Permission::checkSessionToken();
+
 $aZonesIds = array();
 $aZonesIdsHash = array();
 foreach ($_REQUEST['ids'] as $zone) {
@@ -103,4 +105,5 @@ switch ($action) {
 };
 echo "<!--result-info-end-->";
 
-?>
+// CSRF Token
+echo "<!--token-value-start-->".phpAds_SessionGetToken()."<!--token-value-end-->";

programming_language: PHP
filename: channel-acl.php
change_type: ModificationType.MODIFY
diff: @@ -59,6 +59,8 @@ if (!empty($action)) {
     $acl = MAX_AclAdjust($acl, $action);
 }
 elseif (!empty($submit)) {
+    OA_Permission::checkSessionToken();
+
     $acl = (isset($acl)) ? $acl : array();
     // Only save when inputs are valid
     if (OX_AclCheckInputsFields($acl, $pageName) === true) {

programming_language: PHP
filename: channel-modify.php
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,8 @@ if (empty($returnurl)) {
 
 // Security check
 if (isset($channelid) && $channelid != '') {
+    OA_Permission::checkSessionToken();
+
     if (isset($duplicate) && $duplicate == 'true') {
 
         //get channel old channel name

programming_language: PHP
filename: lib-maintenance-priority.inc.php
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@
 function OA_runMPE()
 {
     $objResponse = new xajaxResponse();
-    $objResponse->addAssign("run-mpe", "innerHTML", "<img src='run-mpe.php' />");
+    $objResponse->addAssign("run-mpe", "innerHTML", "<img src='run-mpe.ph?token=".urlencode(phpAds_SessionGetToken())."' />");
     return $objResponse;
 }
 

programming_language: PHP
filename: maintenance-acl-check.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ phpAds_MaintenanceSelection("acls");
 /*-------------------------------------------------------*/
 
 if (!empty($action) && ($action == 'Recompile')) {
+    OA_Permission::checkSessionToken();
+
     MAX_AclReCompileAll();
     echo "<strong>$strAllBannerChannelCompiled</strong><br />";
 }
@@ -94,6 +96,7 @@ if (!$allBannersValid || !$allChannelsValid) {
     echo "<br /><strong>". $strErrorsFound ."</strong><br /><br />";
     echo $strRepairCompiledLimitations;
     echo "<form action='' METHOD='GET'>";
+    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
     echo "<input type='submit' name='action' value='$strRecompile' />";
     echo "</form>";
 }

programming_language: PHP
filename: maintenance-appendcode-check.php
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,8 @@ phpAds_MaintenanceSelection("appendcodes");
 $tr = new MAX_Dal_Inventory_Trackers();
 
 if (!empty($action) && ($action == 'Recompile')) {
+    OA_Permission::checkSessionToken();
+
     $tr->recompileAppendCodes();
     echo "<strong>$strAppendCodesRecompiled<br />";
 }
@@ -68,6 +70,7 @@ if (!$allTrackersValid) {
     echo "<br /><strong>$strErrorsFound</strong><br /><br />";
     echo "$strRepairAppenedCodes<br />";
     echo "<form action='' METHOD='GET'>";
+    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
     echo "<input type='submit' name='action' value='$strRecompile' />";
     echo "</form>";
 }

programming_language: PHP
filename: maintenance-banners-check.php
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,8 @@ phpAds_registerGlobal('action', 'returnurl');
 /*-------------------------------------------------------*/
 
 if (!empty($action) && ($action == 'Rebuild')) {
+    OA_Permission::checkSessionToken();
+
     $result = processBanners(true);
     if (empty($result['errors'])) {
         if (empty($returnurl)) { $returnurl = 'maintenance-banners-check.php'; }
@@ -57,6 +59,7 @@ if (!empty($action) && ($action == 'Rebuild')) {
         _showPageHeader();
         echo $GLOBALS['strBannerCacheDifferencesFound'];
         echo "<form action='' METHOD='GET'>";
+        echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
         echo "<input type='submit' name='action' value='{$GLOBALS['strBannerCacheRebuildButton']}' />";
         echo "</form>";
     } else {

programming_language: PHP
filename: maintenance-encoding.php
change_type: ModificationType.MODIFY
diff: @@ -105,6 +105,8 @@ $aTableFields = array(
 );
 
 if (!empty($_POST['encConfirm'])) {
+    OA_Permission::checkSessionToken();
+
     _iterateTableFields($aTableFields, true);
     Header("Location: maintenance-maintenance.php");
 }
@@ -201,6 +203,7 @@ if (!empty($_POST['encTest'])) {
         }
     }
     echo "</table><br />";
+    echo "<input type='hidden' name='token' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."' />";
     echo "<input type='submit' name='encConfirm' value='{$GLOBALS['strConvert']}' /> <input type='button' name='encCancel' value='{$GLOBALS['strCancel']}' onclick='javascript:document.location = \"" . $_SERVER['SCRIPT_NAME'] . "\";' />";
 }
 

programming_language: PHP
filename: maintenance-menus.php
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,8 @@ echo "<br /><br />";
 
 if (!empty($action))
 {
+    OA_Permission::checkSessionToken();
+
     switch ($action)
     {
         case 'build':
@@ -53,7 +55,7 @@ if (!empty($action))
 }
 
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-menus.php?action=build'>Rebuild Menu Cache</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-menus.php?action=build&amp;token=".urlencode(phpAds_SessionGetToken())."'>Rebuild Menu Cache</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
 
 

programming_language: PHP
filename: maintenance-plugins.php
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,8 @@ phpAds_registerGlobal('action', 'returnurl');
 
 if (!empty($action))
 {
+    OA_Permission::checkSessionToken();
+
     switch ($action)
     {
         case 'rep':
@@ -116,19 +118,21 @@ if (!empty($action))
     }
 }
 
+$token = 'token='.urlencode(phpAds_SessionGetToken()).'&amp;';
+
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=hook'>Rebuild Component Hooks Cache</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=hook'>Rebuild Component Hooks Cache</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=pref'>Rebuild Preferences List</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=pref'>Rebuild Preferences List</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=reg'>Rebuild Delivery Hooks Cache</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=reg'>Rebuild Delivery Hooks Cache</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=rep'>Plugin Report</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=rep'>Plugin Report</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=exp'>Export All Plugins</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=exp'>Export All Plugins</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
 
-/*echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?action=dep'>Check Dependencies</a>&nbsp;&nbsp;";
+/*echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-plugins.php?{$token}action=dep'>Check Dependencies</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();*/
 if ($oTpl)
 {

programming_language: PHP
filename: maintenance-priority-calculate.php
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,7 @@ require_once MAX_PATH . '/lib/OA/Maintenance/Priority.php';
 
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_ADMIN);
+OA_Permission::checkSessionToken();
 
 /*-------------------------------------------------------*/
 /* Main code                                             */

programming_language: PHP
filename: maintenance-priority.php
change_type: ModificationType.MODIFY
diff: @@ -117,7 +117,7 @@ function phpAds_showBanners()
 echo "<br />";
 
 // Show recalculate button
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-priority-calculate.php'>$strRecalculatePriority</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-priority-calculate.php?token=".urlencode(phpAds_SessionGetToken())."'>$strRecalculatePriority</a>&nbsp;&nbsp;";
 echo "<br /><br />";
 phpAds_ShowBreak();
 

programming_language: PHP
filename: maintenance-storage-move.php
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,7 @@ require_once MAX_PATH . '/www/admin/lib-storage.inc.php';
 
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_ADMIN);
+OA_Permission::checkSessionToken();
 
 /*-------------------------------------------------------*/
 /* Main code                                             */

programming_language: PHP
filename: maintenance-storage.php
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ echo $strStorageExplaination;
 echo "<br /><br />";
 
 phpAds_ShowBreak();
-echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-storage-move.php'>$strMoveToDirectory</a>&nbsp;&nbsp;";
+echo "<img src='" . OX::assetPath() . "/images/".$phpAds_TextDirection."/icon-undo.gif' border='0' align='absmiddle'>&nbsp;<a href='maintenance-storage-move.php?token=".urlencode(phpAds_SessionGetToken())."'>$strMoveToDirectory</a>&nbsp;&nbsp;";
 phpAds_ShowBreak();
 
 

programming_language: PHP
filename: run-mpe.php
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,7 @@ require_once MAX_PATH . '/www/admin/config.php';
 require_once MAX_PATH . '/lib/OA/Maintenance/Priority.php';
 
 OA_Permission::enforceAccount(OA_ACCOUNT_MANAGER, OA_ACCOUNT_ADVERTISER);
+OA_Permission::checkSessionToken();
 
 
 // Set longer time out, and ignore user abort

programming_language: PHP
filename: tracker-append.php
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,8 @@ $trackerAppend = new Max_Admin_Inventory_TrackerAppend();
 header("Content-Type: text/html; charset=ISO-8859-1");
 
 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+    OA_Permission::checkSessionToken();
+
     $trackerAppend->handlePost($_POST);
 } else {
     $trackerAppend->handleGet();

programming_language: PHP
filename: tracker-variables.php
change_type: ModificationType.MODIFY
diff: @@ -181,6 +181,8 @@ if (!empty($trackerid))
     // has user clicked on save changes?
     if (isset($action['save']))
     {
+        OA_Permission::checkSessionToken();
+
         // save variablemethod
         $doTrackers = OA_Dal::factoryDO('trackers');
         $doTrackers->get($trackerid);
@@ -305,6 +307,7 @@ $tabindex = 0;
 if (isset($trackerid) && $trackerid != '')
 {
             echo "<form action='".$_SERVER['SCRIPT_NAME']."?clientid=$clientid&trackerid=$trackerid' method='post' onsubmit='return m3_hideShowSubmit()'>\n";
+                echo "<input type='token' name='submit' value='".htmlspecialchars(phpAds_SessionGetToken(), ENT_QUOTES)."'>";
                 echo "<input type='hidden' name='submit' value='true'>";
                 echo "<input type='image' name='dummy' src='" . OX::assetPath() . "/images/spacer.gif' border='0' width='1' height='1'>\n";
                 echo "<br /><br />\n";

programming_language: PHP
filename: updates-history.php
change_type: ModificationType.MODIFY
diff: @@ -99,6 +99,8 @@ $oUpgrader->initDatabaseConnection();
 
 if (array_key_exists('btn_clean_audit', $_POST))
 {
+    OA_Permission::checkSessionToken();
+
     $upgrade_id = $_POST['upgrade_action_id'];
     $oUpgrader->oAuditor->cleanAuditArtifacts($upgrade_id);
 }
@@ -295,6 +297,7 @@ if (count($aMessages)>0)
                         </table>
                     </td>
                     <input type="hidden" name="upgrade_action_id" value="<?php echo $v['upgrade_action_id']; ?>" />
+                    <input type="hidden" name="token" value="<?php echo htmlspecialchars(phpAds_SessionGetToken()); ?>" />
                 </tr>
               </form>
                 <tr height='1'><td colspan='7' bgcolor='#888888'><img src='<?php echo OX::assetPath() ?>/images/break.gif' height='1' width='100%'></td></tr>

programming_language: PHP
filename: zone-modify.php
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,7 @@ OA_Permission::enforceAccessToObject('zones', $zoneid);
 /*-------------------------------------------------------*/
 
 if (isset($zoneid) && $zoneid != '') {
+    OA_Permission::checkSessionToken();
 
     if (isset($newaffiliateid) && $newaffiliateid != '') {
         // A publisher cannot move a zone to another publisher!

programming_language: PHP