diff --git a/app/extensions/extension_download.php b/app/extensions/extension_download.php index 7858c141ba..506b85ab7e 100644 --- a/app/extensions/extension_download.php +++ b/app/extensions/extension_download.php @@ -25,19 +25,19 @@ */ //includes - include "root.php"; + require_once "root.php"; require_once "resources/require.php"; require_once "resources/check_auth.php"; require_once "resources/paging.php"; //check permissions - if (permission_exists('extension_export')) { - //access granted - } - else { - echo "access denied"; - exit; - } + if (permission_exists('extension_export')) { + //access granted + } + else { + echo "access denied"; + exit; + } //add multi-lingual support $language = new text; @@ -131,8 +131,17 @@ //get the extensions from the database and send them as output if (is_array($_REQUEST["column_group"]) && @sizeof($_REQUEST["column_group"]) != 0) { + + //validate the token + $token = new token; + if (!$token->validate($_SERVER['PHP_SELF'])) { + message::add($text['message-invalid_token'],'negative'); + header('Location: extension_download.php'); + exit; + } + //validate submitted columns - foreach($_REQUEST["column_group"] as $column_name) { + foreach ($_REQUEST["column_group"] as $column_name) { if (in_array($column_name, $available_columns)) { $selected_columns[] = $column_name; } @@ -145,73 +154,60 @@ $extensions = $database->select($sql, $parameters, 'all'); unset($sql, $parameters, $selected_columns); - download_send_headers("data_export_".date("Y-m-d").".csv"); + download_send_headers("extension_export_".date("Y-m-d").".csv"); echo array2csv($extensions); exit; } } -//set the row styles - $c = 0; - $row_style["0"] = "row_style0"; - $row_style["1"] = "row_style1"; +//create token + $object = new token; + $token = $object->create($_SERVER['PHP_SELF']); -//begin the page content +//include the header $document['title'] = $text['title-extension_export']; require_once "resources/header.php"; - echo "