diff --git a/app/classes/component.php b/app/classes/component.php index e8f650e..7e45f57 100644 --- a/app/classes/component.php +++ b/app/classes/component.php @@ -70,7 +70,7 @@ class Component { } $stmt = $this->db->prepare($sql); - + // Bind parameters only if they're not default values if ($jitsi_component !== 'jitsi_component') { $stmt->bindValue(':jitsi_component', trim($jitsi_component, "'")); @@ -92,7 +92,7 @@ class Component { $stmt->execute(); $result = $stmt->fetchAll(PDO::FETCH_ASSOC); - + if (!empty($result)) { $logObject->insertLog(0, "Retrieved " . count($result) . " Jitsi component events"); } diff --git a/app/includes/csrf_middleware.php b/app/includes/csrf_middleware.php index 9125114..f55394c 100644 --- a/app/includes/csrf_middleware.php +++ b/app/includes/csrf_middleware.php @@ -3,6 +3,7 @@ require_once __DIR__ . '/../helpers/security.php'; function applyCsrfMiddleware() { + global $dbWeb, $logObject; $security = SecurityHelper::getInstance(); // Skip CSRF check for GET requests @@ -22,9 +23,13 @@ function applyCsrfMiddleware() { $token = $_POST['csrf_token'] ?? ''; if (!$security->verifyCsrfToken($token)) { // Log CSRF attempt - error_log("CSRF attempt detected from IP: " . $_SERVER['REMOTE_ADDR']); -//FIXME log class not loaded -// $logObject->insertLog(0, "CSRF attempt detected from IP: " . $_SERVER['REMOTE_ADDR'], 'system'); + $logMessage = sprintf( + "CSRF attempt detected - IP: %s, Page: %s, User: %s", + $_SERVER['REMOTE_ADDR'], + $_GET['page'] ?? 'unknown', + $_SESSION['username'] ?? 'anonymous' + ); + $logObject->insertLog(0, $logMessage); // Return error message http_response_code(403);