diff --git a/router.php b/router.php index 1bb9fb8..39a558a 100644 --- a/router.php +++ b/router.php @@ -139,7 +139,6 @@ if ($_POST !== []) { // Protect against cross-site request forgery if a POST request is received if (isset($_SERVER['HTTP_SEC_FETCH_SITE']) !== true) output(403, 'The Sec-Fetch-Site HTTP header is required when submitting a POST request to prevent Cross-Site Request Forgery (CSRF).'); - if ($_SERVER['HTTP_SEC_FETCH_SITE'] !== 'same-origin') if (!in_array($_SERVER['HTTP_SEC_FETCH_SITE'], ['none', 'same-origin'], true)) output(403, 'The Sec-Fetch-Site HTTP header must be same-origin or none when submitting a POST request to prevent Cross-Site Request Forgery (CSRF).'); diff --git a/view.php b/view.php index 1f30b8d..1ee3060 100644 --- a/view.php +++ b/view.php @@ -1,14 +1,14 @@ -> +> <?php - foreach (array_reverse(TITLES_LINEAGE) as $id => $title) - echo strip_tags($title) . (array_key_last(TITLES_LINEAGE) === $id ? '' : ' < '); +foreach (array_reverse(TITLES_LINEAGE) as $id => $title) + echo strip_tags($title) . (array_key_last(TITLES_LINEAGE) === $id ? '' : ' < '); ?> ' . LF; +foreach (glob('css/*.css') as $css_path) + echo ' ' . LF; ?> @@ -23,11 +23,11 @@

@@ -38,12 +38,12 @@ if (in_array(SERVICE, SERVICES_USER, true) AND CONF['common']['services'][SERVICE] === 'error') echo '

' . _('This service is currently under maintenance. No action can be taken on it until an administrator finishes repairing it.') . '

'; - require ROOT_PATH . '/pg-view/' . PAGE_ADDRESS . '.php'; +require ROOT_PATH . '/pg-view/' . PAGE_ADDRESS . '.php'; - if ($_POST === [] AND PAGE_METADATA['require-login'] ?? true !== false AND !isset($_SESSION['id']) AND PAGE_TERMINAL) - echo '

' . sprintf(_('This form won\'t be accepted because you need to %slog in%s first.'), '', '') . '

'; +if ($_POST === [] AND PAGE_METADATA['require-login'] ?? true !== false AND !isset($_SESSION['id']) AND PAGE_TERMINAL) + echo '

' . sprintf(_('This form won\'t be accepted because you need to %slog in%s first.'), '', '') . '

'; - displayFinalMessage($data); +displayFinalMessage($data); ?>