Changing REQUEST to POST and GET

Author: mattpass

lib/headers.php

@@ -18,15 +18,17 @@
 	$_SESSION["csrf"] = md5(uniqid(mt_rand(), true));
 }
 
-if (($_GET || $_POST) && (!isset($_REQUEST["csrf"]) || $_REQUEST["csrf"] !== $_SESSION["csrf"])) {
-	$req = isset($_REQUEST["csrf"]) ? xssClean($_REQUEST["csrf"], "html") : "";
-	die($t['Bad CSRF token...'] . "<br><br>
-		CSRF issue:<br>
-		REQUEST: " . $req . "<br>
-		SESSION: " . xssClean($_SESSION["csrf"], "html") . "<br>
-		FILE: " . xssClean($_SERVER["SCRIPT_NAME"], "html") . "<br>
-		GET: " . xssClean(var_export($_GET, true), "html") . "<br>
-		POST: " . xssClean(var_export($_POST, true), "html"));
+if (($_POST || $_GET) && !$_POST["csrf"] && !$_GET["csrf"]) {
+	$req = xssClean($_POST["csrf"] ?? $_GET['csrf'] ?? "", "html");
+    if ($req !== $_SESSION["csrf"]) {
+        die($t['Bad CSRF token...'] . "<br><br>
+            CSRF issue:<br>
+            REQUEST: " . $req . "<br>
+            SESSION: " . xssClean($_SESSION["csrf"], "html") . "<br>
+            FILE: " . xssClean($_SERVER["SCRIPT_NAME"], "html") . "<br>
+            GET: " . xssClean(var_export($_GET, true), "html") . "<br>
+            POST: " . xssClean(var_export($_POST, true), "html"));
+    }
 }
 
 if (!headers_sent()) {