CX XSRF @ admin/specialhours.php [master]

[cxronen]

XSRF issue exists @ admin/specialhours.php in branch master

Method <?php at line 76 of admin\specialhours.php gets a parameter from a user request from _REQUEST. This parameter value flows through the code and is eventually used to access application state altering functionality. This may enable Cross-Site Request Forgery (XSRF).

Severity: Medium

CWE:352

Checkmarx

Training
Recommended Fix

Lines: 25 26 76 31

---

Code (Line #25):

				$from = isset($_REQUEST["from"])?$_REQUEST["from"]:"";

---

Code (Line #26):

				$to = isset($_REQUEST["to"])?$_REQUEST["to"]:"";

---

Code (Line #76):

				$roomspecialhoursid = isset($_REQUEST["roomspecialhoursid"])?$_REQUEST["roomspecialhoursid"]:"";

---

Code (Line #31):

				$affectedrooms = isset($_REQUEST["affectedrooms"])?$_REQUEST["affectedrooms"]:"";

---