Harden admin AJAX and improve mega menu links

2026-04-28 07:54:10 +00:00
parent cc7069e695
commit 501f6c4b07
5 changed files with 102 additions and 48 deletions
@@ -387,6 +387,8 @@ class AdvancedMegaMenu extends Module implements WidgetInterface

    private function ajaxRouter(): void
    {
+        $this->assertAdminToken();
+
        $action = (string) Tools::getValue('action');

        if ($action === 'searchProducts') {
@@ -401,6 +403,20 @@ class AdvancedMegaMenu extends Module implements WidgetInterface
        exit(json_encode(['error' => true, 'message' => 'Unknown action']));
    }

+    private function assertAdminToken(): void
+    {
+        $token = (string) Tools::getValue('token');
+        $expectedToken = Tools::getAdminTokenLite('AdminModules');
+
+        if (!hash_equals($expectedToken, $token)) {
+            header('Content-Type: application/json', true, 403);
+            exit(json_encode([
+                'error' => true,
+                'message' => $this->trans('Invalid admin token.', [], 'Modules.Advancedmegamenu.Admin'),
+            ]));
+        }
+    }
+
    private function ajaxSearchProducts(): void
    {
        $term = pSQL((string) Tools::getValue('q'));