use CSRF protection when creating/editing/deleting an OER material, fixes #3268

Closes #3268

Merge request studip/studip!2210

app/controllers/oer/mymaterial.php

@@ -28,12 +28,14 @@ class Oer_MymaterialController extends AuthenticatedController
         $content_types = ['application/x-zip-compressed', 'application/zip', 'application/x-zip'];
         $tmp_folder = $GLOBALS['TMP_PATH'] . '/temp_folder_' . md5(uniqid());
         if (Request::submitted('delete') && Request::isPost()) {
+            CSRFProtection::verifyUnsafeRequest();
             $material->pushDataToIndexServers('delete');
             $material->delete();
             PageLayout::postSuccess(_('Das Material wurde gelöscht.'));
             $this->redirect('oer/market/index');
             return;
         } elseif (Request::isPost()) {
+            CSRFProtection::verifyUnsafeRequest();
             $was_new = $material->isNew();
             $was_on_twillo = (bool) $material['published_id_on_twillo'];
             $data = Request::getArray('data');

app/views/oer/market/details.php

@@ -73,6 +73,7 @@
         <? if (!$material['host_id'] && ($material->isMine() || $GLOBALS['perm']->have_perm("root"))) : ?>
             <?= \Studip\LinkButton::create(_('Bearbeiten'), $controller->link_for("oer/mymaterial/edit/".$material->getId()), ['data-dialog' => "1"]) ?>
             <form action="<?= $controller->link_for("oer/mymaterial/edit/".$material->getId()) ?>" method="post" style="display: inline;">
+                <?= CSRFProtection::tokenTag() ?>
                 <?= \Studip\Button::create(_('Löschen'), "delete", ['value' => 1, 'data-confirm' => _('Wirklich löschen?')]) ?>
             </form>
         <? endif ?>

app/views/oer/mymaterial/edit.php

@@ -4,7 +4,7 @@
       onsubmit="$(window).off('beforeunload')"
       data-secure
       enctype="multipart/form-data">
-
+    <?= CSRFProtection::tokenTag() ?>
     <div class="oercampus_editmaterial">
         <fieldset>
             <legend><?= _('Grunddaten') ?></legend>