Index: branches/2.8.x/CHANGELOG
===================================================================
--- branches/2.8.x/CHANGELOG	(revision 1388)
+++ branches/2.8.x/CHANGELOG	(revision 1389)
@@ -11,6 +11,8 @@
 ! = Update/Change
 
 ------------------------------------- 2.8.2 -------------------------------------
+16 Jan-2011 Build 1389 Frank Heyne (FrankH)
+# Security fixes for modules captcha_control, code and droplets
 16 Jan-2011 Build 1388 Dietmar Woellbrink (Luisehahne)
 # more Security fix for admin/pages
 16 Jan-2011 Build 1387 Dietmar Woellbrink (Luisehahne)
Index: branches/2.8.x/wb/admin/interface/version.php
===================================================================
--- branches/2.8.x/wb/admin/interface/version.php	(revision 1388)
+++ branches/2.8.x/wb/admin/interface/version.php	(revision 1389)
@@ -52,6 +52,6 @@
 
 // check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled)
 if(!defined('VERSION')) define('VERSION', '2.8.2.RC4');
-if(!defined('REVISION')) define('REVISION', '1388');
+if(!defined('REVISION')) define('REVISION', '1389');
 
 ?>
Index: branches/2.8.x/wb/modules/captcha_control/info.php
===================================================================
--- branches/2.8.x/wb/modules/captcha_control/info.php	(revision 1388)
+++ branches/2.8.x/wb/modules/captcha_control/info.php	(revision 1389)
@@ -31,7 +31,7 @@
 $module_directory 	= 'captcha_control';
 $module_name 			= 'Captcha and Advanced-Spam-Protection (ASP) Control';
 $module_function 		= 'tool';
-$module_version 		= '1.0';
+$module_version 		= '1.1';
 $module_platform 		= '2.7 | 2.8.x';
 $module_author 		= 'Thomas Hornik (thorn)';
 $module_license 		= 'GNU General Public License';
Index: branches/2.8.x/wb/modules/captcha_control/tool.php
===================================================================
--- branches/2.8.x/wb/modules/captcha_control/tool.php	(revision 1388)
+++ branches/2.8.x/wb/modules/captcha_control/tool.php	(revision 1389)
@@ -1,197 +1,204 @@
-<?php
-
-// $Id$
-
-/*
-
- Website Baker Project <http://www.websitebaker.org/>
- Copyright (C) 2004-2009, Ryan Djurovich
-
- Website Baker is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- Website Baker is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with Website Baker; if not, write to the Free Software
- Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-*/
-
-// direct access prevention
-defined('WB_PATH') OR die(header('Location: ../index.php'));
-
-// check if module language file exists for the language set by the user (e.g. DE, EN)
-if(!file_exists(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php')) {
-	// no module language file exists for the language set by the user, include default module language file EN.php
-	require_once(WB_PATH .'/modules/captcha_control/languages/EN.php');
-} else {
-	// a module language file exists for the language defined by the user, load it
-	require_once(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php');
-}
-
-$table = TABLE_PREFIX.'mod_captcha_control';
-$js_back = "javascript: history.go(-1);";
-
-// check if data was submitted
-if(isset($_POST['save_settings'])) {
-	// get configuration settings
-	$enabled_captcha = ($_POST['enabled_captcha'] == '1') ? '1' : '0';
-	$enabled_asp = ($_POST['enabled_asp'] == '1') ? '1' : '0';
-	$captcha_type = $admin->add_slashes($_POST['captcha_type']);
-	
-	// update database settings
-	$database->query("UPDATE $table SET
-		enabled_captcha = '$enabled_captcha',
-		enabled_asp = '$enabled_asp',
-		captcha_type = '$captcha_type'
-	");
-
-	// save text-captchas
-	if($captcha_type == 'text') { // ct_text
-		$text_qa=$admin->add_slashes($_POST['text_qa']);
-		if(!preg_match('/### .*? ###/', $text_qa)) {
-			$database->query("UPDATE $table SET ct_text = '$text_qa'");
-		}
-	}
-	
-	// check if there is a database error, otherwise say successful
-	if($database->is_error()) {
-		$admin->print_error($database->get_error(), $js_back);
-	} else {
-		$admin->print_success($MESSAGE['PAGES']['SAVED'], ADMIN_URL.'/admintools/tool.php?tool=captcha_control');
-	}
-
-} else {
-	
-	// include captcha-file
-	require_once(WB_PATH .'/include/captcha/captcha.php');
-
-	// load text-captchas
-	$text_qa='';
-	if($query = $database->query("SELECT ct_text FROM $table")) {
-		$data = $query->fetchRow();
-		$text_qa = $data['ct_text'];
-	}
-	if($text_qa == '')
-		$text_qa = $MOD_CAPTCHA_CONTROL['CAPTCHA_TEXT_DESC'];
-
-// script to load image
-?>
-<script type="text/javascript">
-	var pics = new Array();
-
-	pics["ttf_image"] = new Image();
-	pics["ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/ttf_image.png'?>";
-
-	pics["calc_image"] = new Image();
-	pics["calc_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_image.png'?>";
-
-	pics["calc_ttf_image"] = new Image();
-	pics["calc_ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_ttf_image.png'?>";
-
-	pics["old_image"] = new Image();
-	pics["old_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/old_image.png'?>";
-	
-	pics["calc_text"] = new Image();
-	pics["calc_text"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_text.png'?>";
-	
-	pics["text"] = new Image();
-	pics["text"].src = "<?php echo WB_URL.'/include/captcha/captchas/text.png'?>";
-
-	function load_captcha_image() {
-		document.captcha_example.src = pics[document.store_settings.captcha_type.value].src;
-		toggle_text_qa();
-	}
-	
-	function toggle_text_qa() {
-		if(document.store_settings.captcha_type.value == 'text' ) {
-			document.getElementById('text_qa').style.display = '';
-		} else {
-			document.getElementById('text_qa').style.display = 'none';
-		}
-	}
-
-</script>
-<?php
-
-	// connect to database and read out captcha settings
-	if($query = $database->query("SELECT * FROM $table")) {
-		$data = $query->fetchRow();
-		$enabled_captcha = $data['enabled_captcha'];
-		$enabled_asp = $data['enabled_asp'];
-		$captcha_type = $data['captcha_type'];
-	} else {
-		// something went wrong, use dummy value
-		$enabled_captcha = '1';
-		$enabled_asp = '1';
-		$captcha_type = 'calc_text';
-	}
-		
-	// write out heading
-	echo '<h2>' .$MOD_CAPTCHA_CONTROL['HEADING'] .'</h2>';
-
-	// output the form with values from the database
-	echo '<p>' .$MOD_CAPTCHA_CONTROL['HOWTO'] .'</p>';
-?>
-<form name="store_settings" action="<?php echo $_SERVER['REQUEST_URI']; ?>" method="post">
-	<table width="98%" cellspacing="0" border="0" cellpadding="5px" class="row_a">
-	<tr><td colspan="2"><strong><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_CONF'];?>:</strong></td></tr>
-	<tr>
-		<td width="30%"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_TYPE'];?>:</td>
-		<td>
-		<select name="captcha_type" id="captcha_type" onchange="load_captcha_image()" style="width: 98%;">
-			<?php foreach($useable_captchas AS $key=>$text) {
-			echo "<option value=\"$key\" ".($captcha_type==$key ? ' selected="selected"' : '').">$text</option>";
-			} ?>
-		</select>
-		</td>
-	</tr>
-	<tr>
-		<td>&nbsp;</td>
-		<td align="left" width="150px">
-            <img alt="captcha_example" id="captcha_example" src="<?php echo WB_URL.'/include/captcha/captchas/'.$captcha_type.'.png'?>" />
-        </td>
-	</tr>
-	<tr id="text_qa" style="display:<?php if($captcha_type=='text') echo ''; else echo 'none'; ;?>;">
-		<td valign="top" class="setting_name"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_ENTER_TEXT'];?>:</td>
-		<td class="setting_value" colspan="2">
-			<textarea name="text_qa" cols="60" rows="10"><?php echo $text_qa; ?></textarea>
-		</td>
-	</tr>
-	<tr>
-		<td><?php echo $MOD_CAPTCHA_CONTROL['USE_SIGNUP_CAPTCHA'];?>:</td>
-		<td>
-			<input type="radio" <?php echo ($enabled_captcha=='1') ?'checked="checked"' :'';?>
-				name="enabled_captcha" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
-			<input type="radio" <?php echo ($enabled_captcha=='0') ?'checked="checked"' :'';?>
-				name="enabled_captcha" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
-		</td>
-	</tr>
-	<tr><td>&nbsp;</td><td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_EXP'];?></td></tr>
-	<tr><td colspan="2"><br /><strong><?php echo $MOD_CAPTCHA_CONTROL['ASP_CONF'];?>:</strong></td></tr>
-	<tr>
-		<td><?php echo $MOD_CAPTCHA_CONTROL['ASP_TEXT'];?>:</td>
-		<td>
-			<input type="radio" <?php echo ($enabled_asp=='1') ?'checked="checked"' :'';?>
-				name="enabled_asp" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
-			<input type="radio" <?php echo ($enabled_asp=='0') ?'checked="checked"' :'';?>
-				name="enabled_asp" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
-		</td>
-	</tr>
-	<tr>
-        <td>&nbsp;</td>
-        <td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['ASP_EXP'];?></td>
-    </tr>
-	</table>
-	<input type="submit" name="save_settings" style="margin-top:10px; width:140px;" value="<?php echo $TEXT['SAVE']; ?>" />
-</form>
-<?php
-}
-
+<?php
+
+// $Id$
+
+/*
+
+ Website Baker Project <http://www.websitebaker.org/>
+ Copyright (C) 2004-2009, Ryan Djurovich
+
+ Website Baker is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ Website Baker is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with Website Baker; if not, write to the Free Software
+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+*/
+
+// direct access prevention
+defined('WB_PATH') OR die(header('Location: ../index.php'));
+
+// check if module language file exists for the language set by the user (e.g. DE, EN)
+if(!file_exists(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php')) {
+	// no module language file exists for the language set by the user, include default module language file EN.php
+	require_once(WB_PATH .'/modules/captcha_control/languages/EN.php');
+} else {
+	// a module language file exists for the language defined by the user, load it
+	require_once(WB_PATH .'/modules/captcha_control/languages/'.LANGUAGE .'.php');
+}
+
+$table = TABLE_PREFIX.'mod_captcha_control';
+$js_back = "javascript: history.go(-1);";
+
+// check if data was submitted
+if(isset($_POST['save_settings'])) {
+	if (!$admin->checkFTAN())
+	{
+		$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
+		exit();
+	}
+	
+	// get configuration settings
+	$enabled_captcha = ($_POST['enabled_captcha'] == '1') ? '1' : '0';
+	$enabled_asp = ($_POST['enabled_asp'] == '1') ? '1' : '0';
+	$captcha_type = $admin->add_slashes($_POST['captcha_type']);
+	
+	// update database settings
+	$database->query("UPDATE $table SET
+		enabled_captcha = '$enabled_captcha',
+		enabled_asp = '$enabled_asp',
+		captcha_type = '$captcha_type'
+	");
+
+	// save text-captchas
+	if($captcha_type == 'text') { // ct_text
+		$text_qa=$admin->add_slashes($_POST['text_qa']);
+		if(!preg_match('/### .*? ###/', $text_qa)) {
+			$database->query("UPDATE $table SET ct_text = '$text_qa'");
+		}
+	}
+	
+	// check if there is a database error, otherwise say successful
+	if($database->is_error()) {
+		$admin->print_error($database->get_error(), $js_back);
+	} else {
+		$admin->print_success($MESSAGE['PAGES']['SAVED'], ADMIN_URL.'/admintools/tool.php?tool=captcha_control');
+	}
+
+} else {
+	
+	// include captcha-file
+	require_once(WB_PATH .'/include/captcha/captcha.php');
+
+	// load text-captchas
+	$text_qa='';
+	if($query = $database->query("SELECT ct_text FROM $table")) {
+		$data = $query->fetchRow();
+		$text_qa = $data['ct_text'];
+	}
+	if($text_qa == '')
+		$text_qa = $MOD_CAPTCHA_CONTROL['CAPTCHA_TEXT_DESC'];
+
+// script to load image
+?>
+<script type="text/javascript">
+	var pics = new Array();
+
+	pics["ttf_image"] = new Image();
+	pics["ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/ttf_image.png'?>";
+
+	pics["calc_image"] = new Image();
+	pics["calc_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_image.png'?>";
+
+	pics["calc_ttf_image"] = new Image();
+	pics["calc_ttf_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_ttf_image.png'?>";
+
+	pics["old_image"] = new Image();
+	pics["old_image"].src = "<?php echo WB_URL.'/include/captcha/captchas/old_image.png'?>";
+	
+	pics["calc_text"] = new Image();
+	pics["calc_text"].src = "<?php echo WB_URL.'/include/captcha/captchas/calc_text.png'?>";
+	
+	pics["text"] = new Image();
+	pics["text"].src = "<?php echo WB_URL.'/include/captcha/captchas/text.png'?>";
+
+	function load_captcha_image() {
+		document.captcha_example.src = pics[document.store_settings.captcha_type.value].src;
+		toggle_text_qa();
+	}
+	
+	function toggle_text_qa() {
+		if(document.store_settings.captcha_type.value == 'text' ) {
+			document.getElementById('text_qa').style.display = '';
+		} else {
+			document.getElementById('text_qa').style.display = 'none';
+		}
+	}
+
+</script>
+<?php
+
+	// connect to database and read out captcha settings
+	if($query = $database->query("SELECT * FROM $table")) {
+		$data = $query->fetchRow();
+		$enabled_captcha = $data['enabled_captcha'];
+		$enabled_asp = $data['enabled_asp'];
+		$captcha_type = $data['captcha_type'];
+	} else {
+		// something went wrong, use dummy value
+		$enabled_captcha = '1';
+		$enabled_asp = '1';
+		$captcha_type = 'calc_text';
+	}
+		
+	// write out heading
+	echo '<h2>' .$MOD_CAPTCHA_CONTROL['HEADING'] .'</h2>';
+
+	// output the form with values from the database
+	echo '<p>' .$MOD_CAPTCHA_CONTROL['HOWTO'] .'</p>';
+?>
+<form name="store_settings" action="<?php echo $_SERVER['REQUEST_URI']; ?>" method="post">
+	<?php echo $admin->getFTAN(); ?>
+	<table width="98%" cellspacing="0" border="0" cellpadding="5px" class="row_a">
+	<tr><td colspan="2"><strong><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_CONF'];?>:</strong></td></tr>
+	<tr>
+		<td width="30%"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_TYPE'];?>:</td>
+		<td>
+		<select name="captcha_type" id="captcha_type" onchange="load_captcha_image()" style="width: 98%;">
+			<?php foreach($useable_captchas AS $key=>$text) {
+			echo "<option value=\"$key\" ".($captcha_type==$key ? ' selected="selected"' : '').">$text</option>";
+			} ?>
+		</select>
+		</td>
+	</tr>
+	<tr>
+		<td>&nbsp;</td>
+		<td align="left" width="150px">
+            <img alt="captcha_example" id="captcha_example" src="<?php echo WB_URL.'/include/captcha/captchas/'.$captcha_type.'.png'?>" />
+        </td>
+	</tr>
+	<tr id="text_qa" style="display:<?php if($captcha_type=='text') echo ''; else echo 'none'; ;?>;">
+		<td valign="top" class="setting_name"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_ENTER_TEXT'];?>:</td>
+		<td class="setting_value" colspan="2">
+			<textarea name="text_qa" cols="60" rows="10"><?php echo $text_qa; ?></textarea>
+		</td>
+	</tr>
+	<tr>
+		<td><?php echo $MOD_CAPTCHA_CONTROL['USE_SIGNUP_CAPTCHA'];?>:</td>
+		<td>
+			<input type="radio" <?php echo ($enabled_captcha=='1') ?'checked="checked"' :'';?>
+				name="enabled_captcha" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
+			<input type="radio" <?php echo ($enabled_captcha=='0') ?'checked="checked"' :'';?>
+				name="enabled_captcha" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
+		</td>
+	</tr>
+	<tr><td>&nbsp;</td><td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['CAPTCHA_EXP'];?></td></tr>
+	<tr><td colspan="2"><br /><strong><?php echo $MOD_CAPTCHA_CONTROL['ASP_CONF'];?>:</strong></td></tr>
+	<tr>
+		<td><?php echo $MOD_CAPTCHA_CONTROL['ASP_TEXT'];?>:</td>
+		<td>
+			<input type="radio" <?php echo ($enabled_asp=='1') ?'checked="checked"' :'';?>
+				name="enabled_asp" value="1" /><?php echo $MOD_CAPTCHA_CONTROL['ENABLED'];?>
+			<input type="radio" <?php echo ($enabled_asp=='0') ?'checked="checked"' :'';?>
+				name="enabled_asp" value="0" /><?php echo $MOD_CAPTCHA_CONTROL['DISABLED'];?>
+		</td>
+	</tr>
+	<tr>
+        <td>&nbsp;</td>
+        <td style="font-size:smaller;"><?php echo $MOD_CAPTCHA_CONTROL['ASP_EXP'];?></td>
+    </tr>
+	</table>
+	<input type="submit" name="save_settings" style="margin-top:10px; width:140px;" value="<?php echo $TEXT['SAVE']; ?>" />
+</form>
+<?php
+}
+
 ?>
\ No newline at end of file
Index: branches/2.8.x/wb/modules/code/htt/modify.htt
===================================================================
--- branches/2.8.x/wb/modules/code/htt/modify.htt	(revision 1388)
+++ branches/2.8.x/wb/modules/code/htt/modify.htt	(revision 1389)
@@ -5,7 +5,7 @@
 
 <input type="hidden" name="page_id" value="{PAGE_ID}" />
 <input type="hidden" name="section_id" value="{SECTION_ID}" />
-
+{FTAN}
 <textarea cols="2" rows="20"  id="content{SECTION}" name="content" style="width: 100%; height: 380px">{CONTENT}</textarea>
 
 <table cellpadding="0" cellspacing="0" border="0" width="100%" >
Index: branches/2.8.x/wb/modules/code/info.php
===================================================================
--- branches/2.8.x/wb/modules/code/info.php	(revision 1388)
+++ branches/2.8.x/wb/modules/code/info.php	(revision 1389)
@@ -19,7 +19,7 @@
 $module_directory	= 'code';
 $module_name		= 'Code';
 $module_function	= 'page';
-$module_version		= '2.8.1';
+$module_version		= '2.8.2';
 $module_platform	= '2.7 | 2.8.x';
 $module_author		= 'Ryan Djurovich';
 $module_license		= 'GNU General Public License';
Index: branches/2.8.x/wb/modules/code/save.php
===================================================================
--- branches/2.8.x/wb/modules/code/save.php	(revision 1388)
+++ branches/2.8.x/wb/modules/code/save.php	(revision 1389)
@@ -22,6 +22,12 @@
 $update_when_modified = true; // Tells script to update when this page was last updated
 require(WB_PATH.'/modules/admin.php');
 
+if (!$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
+	exit();
+}
+
 // Update the mod_wysiwygs table with the contents
 if(isset($_POST['content'])) {
 	$tags = array('<?php', '?>' , '<?');
Index: branches/2.8.x/wb/modules/code/modify.php
===================================================================
--- branches/2.8.x/wb/modules/code/modify.php	(revision 1388)
+++ branches/2.8.x/wb/modules/code/modify.php	(revision 1389)
@@ -37,7 +37,8 @@
 		'CONTENT'				=> $content,
 		'TEXT_SAVE'				=> $TEXT['SAVE'],
 		'TEXT_CANCEL'			=> $TEXT['CANCEL'],
-		'SECTION'				=> $section_id
+		'SECTION'				=> $section_id,
+		'FTAN'					=> $admin->getFTAN()
 	)
 );
 
Index: branches/2.8.x/wb/modules/droplets/delete_droplet.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/delete_droplet.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/delete_droplet.php	(revision 1389)
@@ -19,17 +19,17 @@
 
 require('../../config.php');
 
-// Get id
-if(!isset($_GET['droplet_id']) OR !is_numeric($_GET['droplet_id'])) {
-	header("Location: ".ADMIN_URL."/pages/index.php");
-} else {
-	$droplet_id = $_GET['droplet_id'];
-}
-
 // Include WB admin wrapper script
 require_once(WB_PATH.'/framework/class.admin.php');
 require_once(WB_PATH.'/framework/functions.php');
 
+// Get id
+$droplet_id = $admin->checkIDKEY('droplet_id', false, 'GET');
+if (!$droplet_id) {
+ $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
+ exit();
+}
+
 // check website baker platform (with WB 2.7, Admin-Tools were moved out of settings dialogue)
 if(file_exists(ADMIN_PATH .'/admintools/tool.php')) {
 	$admintool_link = ADMIN_URL .'/admintools/index.php';
Index: branches/2.8.x/wb/modules/droplets/info.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/info.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/info.php	(revision 1389)
@@ -20,7 +20,7 @@
 $module_directory = 'droplets';
 $module_name = 'Droplets';
 $module_function = 'tool';
-$module_version = '1.0.3';
+$module_version = '1.0.4';
 $module_platform = '2.8.x';
 $module_author = 'Ruud and pcwacht';
 $module_license = 'GNU General Public License';
Index: branches/2.8.x/wb/modules/droplets/tool.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/tool.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/tool.php	(revision 1389)
@@ -58,7 +58,7 @@
 	<td valign="top" width="50%" align="right">
 		<a href="#" onclick="javascript: window.open('<?php echo WB_URL; ?>/modules/droplets/readme/<?php echo $DR_TEXT['README']; ?>','helpwindow','width=700,height=550,directories=no,location=no,menubar=no,scrollbars=yes,status=no,toolbar=no,resizable=yes');"><?php echo $DR_TEXT['HELP']; ?></a>
 		<br /><br />
-		<a href="#" onclick="javascript: window.location = '<?php echo WB_URL; ?>/modules/droplets/backup_droplets.php';"><?php echo $DR_TEXT['BACKUP']; ?></a>
+		<a href="#" onclick="javascript: window.location = '<?php echo WB_URL; ?>/modules/droplets/backup_droplets.php?id=<?php echo $admin->getIDKEY(999) . '\';">' .$DR_TEXT['BACKUP']; ?></a>
 	</td>
 </tr>
 </table>
@@ -108,12 +108,12 @@
 		
 		<tr class="row_<?php echo $row; ?>" >
 			<td >
-				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $droplet['id']?>" title="<?php echo $TEXT['MODIFY']; ?>">
+				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $admin->getIDKEY($droplet['id']); ?>" title="<?php echo $TEXT['MODIFY']; ?>">
 					<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="Modify" /> 
 				</a>
 			</td>
 			<td >
-				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $droplet['id']?>" class="tooltip">
+				<a href="<?php echo WB_URL; ?>/modules/droplets/modify_droplet.php?droplet_id=<?php echo $admin->getIDKEY($droplet['id']); ?>" class="tooltip">
 							<?php if ($valid_code && $unique_droplet) { ?><img src="<?php echo WB_URL; ?>/modules/droplets/img/droplet.png" border="0" alt=""/>
 							<?php } else {  ?><img src="<?php echo WB_URL; ?>/modules/droplets/img/invalid.gif" border="0" title="" alt=""/><?php }  ?>
 					<?php echo $droplet['name']; ?><?php echo $comments; ?>
@@ -126,7 +126,7 @@
 				<b><?php if($droplet['active'] == 1){ echo '<span style="color: green;">'. $TEXT['YES']. '</span>'; } else { echo '<span style="color: red;">'.$TEXT['NO'].'</span>';  } ?></b>
 			</td>
 			<td >
-				<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/droplets/delete_droplet.php?droplet_id=<?php echo $droplet['id']?>');" title="<?php echo $TEXT['DELETE']; ?>">
+				<a href="javascript: confirm_link('<?php echo $TEXT['ARE_YOU_SURE']; ?>', '<?php echo WB_URL; ?>/modules/droplets/delete_droplet.php?droplet_id=<?php echo $admin->getIDKEY($droplet['id']); ?>');" title="<?php echo $TEXT['DELETE']; ?>">
 					<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="X" />
 				</a>
 			</td>
Index: branches/2.8.x/wb/modules/droplets/modify_droplet.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/modify_droplet.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/modify_droplet.php	(revision 1389)
@@ -19,16 +19,16 @@
 
 require('../../config.php');
 
+require_once(WB_PATH.'/framework/class.admin.php');
+require_once(WB_PATH.'/framework/functions.php');
+
 // Get id
-if(!isset($_GET['droplet_id']) OR !is_numeric($_GET['droplet_id'])) {
-	header("Location: ".ADMIN_URL."/pages/index.php");
-} else {
-	$droplet_id = $_GET['droplet_id'];
+$droplet_id = $admin->checkIDKEY('droplet_id', false, 'GET');
+if (!$droplet_id) {
+ $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
+ exit();
 }
 
-require_once(WB_PATH.'/framework/class.admin.php');
-require_once(WB_PATH.'/framework/functions.php');
-
 $admintool_link = ADMIN_URL .'/admintools/index.php';
 $module_edit_link = ADMIN_URL .'/admintools/tool.php?tool=droplets';
 $admin = new admin('admintools', 'admintools');
@@ -70,6 +70,7 @@
 <input type="hidden" name="data_codepress" value="" />
 <input type="hidden" name="droplet_id" value="<?php echo $droplet_id; ?>" />
 <input type="hidden" name="show_wysiwyg" value="<?php echo $fetch_content['show_wysiwyg']; ?>" />
+<?php echo $admin->getFTAN(); ?>
 
 <table class="row_a" cellpadding="4" cellspacing="0" border="0" width="100%">
 		<tr>
Index: branches/2.8.x/wb/modules/droplets/add_droplet.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/add_droplet.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/add_droplet.php	(revision 1389)
@@ -41,7 +41,7 @@
 	if($database->is_error()) {
 		$admin->print_error($database->get_error(), $module_edit_link);
 	} else {
-		$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='.$droplet_id);
+		$admin->print_success($TEXT['SUCCESS'], WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='. $admin->getIDKEY($droplet_id));
 	}
 
 	// Print admin footer
Index: branches/2.8.x/wb/modules/droplets/backup_droplets.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/backup_droplets.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/backup_droplets.php	(revision 1389)
@@ -20,6 +20,7 @@
 // tool_edit.php
 require_once('../../config.php');
 require_once(WB_PATH.'/framework/class.admin.php');
+
 require_once(WB_PATH.'/framework/functions.php');
 // create admin object depending on platform (admin tools were moved out of settings with WB 2.7)
 $admin = new admin('admintools', 'admintools');
@@ -27,6 +28,12 @@
 $module_edit_link = ADMIN_URL .'/admintools/tool.php?tool=droplets';
 $template_edit_link = ADMIN_URL .'/admintools/tool.php?tool=templateedit';
 
+// protect from CSRF
+$id = $admin->checkIDKEY('id', false, 'GET');
+if (!$id or $id != 999) {
+ $admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
+ exit();
+}
 
 ?>
 <h4 style="margin: 0; border-bottom: 1px solid #DDD; padding-bottom: 5px;">
Index: branches/2.8.x/wb/modules/droplets/save_droplet.php
===================================================================
--- branches/2.8.x/wb/modules/droplets/save_droplet.php	(revision 1388)
+++ branches/2.8.x/wb/modules/droplets/save_droplet.php	(revision 1389)
@@ -23,12 +23,18 @@
 if(!isset($_POST['droplet_id']) OR !is_numeric($_POST['droplet_id'])) {
 	header("Location: ".ADMIN_URL."/pages/index.php");
 } else {
-	$droplet_id = $_POST['droplet_id'];
+	$droplet_id = (int) $_POST['droplet_id'];
 }
 // Include WB admin wrapper script
 require_once(WB_PATH.'/framework/class.admin.php');
 require_once(WB_PATH.'/framework/functions.php');
 
+if (!$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], ADMIN_URL);
+	exit();
+}
+
 // check website baker platform (with WB 2.7, Admin-Tools were moved out of settings dialogue)
 if(file_exists(ADMIN_PATH .'/admintools/tool.php')) {
 	$admintool_link = ADMIN_URL .'/admintools/index.php';
@@ -45,10 +51,10 @@
 	$admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='.$droplet_id);
 } else {
 	$title = $admin->add_slashes($admin->get_post('title'));
-	$active = $admin->get_post('active');
-	$admin_view = $admin->get_post('admin_view');
-	$admin_edit = $admin->get_post('admin_edit');
-	$show_wysiwyg = $admin->get_post('show_wysiwyg');
+	$active = (int) $admin->get_post('active');
+	$admin_view = (int) $admin->get_post('admin_view');
+	$admin_edit = (int) $admin->get_post('admin_edit');
+	$show_wysiwyg = (int) $admin->get_post('show_wysiwyg');
 	$description = $admin->add_slashes($admin->get_post('description'));
 	$tags = array('<?php', '?>' , '<?');
 	$content = $admin->add_slashes(str_replace($tags, '', $_POST['savecontent']));
@@ -55,7 +61,7 @@
 	
 	$comments = $admin->add_slashes($admin->get_post('comments'));
 	$modified_when = time();
-	$modified_by = $admin->get_user_id(); 
+	$modified_by = (int) $admin->get_user_id(); 
 }
 
 // Update row
@@ -63,7 +69,7 @@
 
 // Check if there is a db error, otherwise say successful
 if($database->is_error()) {
-	$admin->print_error($database->get_error(), WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='.$droplet_id);
+	$admin->print_error($database->get_error(), WB_URL.'/modules/droplets/modify_droplet.php?droplet_id='. $admin->getIDKEY($droplet_id));
 } else {
     $admin->print_success($TEXT['SUCCESS'], $module_edit_link);
 }
