URL-Call with CSRF-Token [Admidio-Wiki2]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== URL-Call with CSRF-Token ======
If you want to call an URL that will directly create, edit oder delete data than you should sent a CSRF-Token with that request as a POST parameter. This token should be checked within the called function. If a token is set, an attacker who call this URL directly will get an error response.

To implement a URL call with CSRF-Token check you must simply add the CSS class ''admidio-send-csrf-token'' to the element where the user should to the mouse click. Also add the attributes ''data-url'' with the url that should be called and the attribute ''data-csrf-token'' with the token.
<code html><a id="adm_download" class="btn btn-primary admidio-send-csrf-token" data-url="https://www.example.com/test/test.php" data-csrf-token="EhKkLWN0z1BPPnhZ3Uk9CC388VpQg3">
   <i class="bi bi-download"></i>Download
</a></code>

Within the PHP script that will receive that call you can simply add the following line:
<code php>SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);</code>

Now your call is protected by an CSRF token :)