From 2425496e4371fbb95987d0cef08eb7f3160d6265 Mon Sep 17 00:00:00 2001
From: Tatevik <tatevikg1@gmail.com>
Date: Tue, 28 Jul 2026 13:36:29 +0400
Subject: [PATCH] verifyCsrfGetToken on delete actions

---
 public_html/lists/admin/admin.php       | 1 +
 public_html/lists/admin/admins.php      | 1 +
 public_html/lists/admin/bouncerule.php  | 1 +
 public_html/lists/admin/bouncerules.php | 1 +
 4 files changed, 4 insertions(+)

diff --git a/public_html/lists/admin/admin.php b/public_html/lists/admin/admin.php
index f505ee747..06e109c59 100644
--- a/public_html/lists/admin/admin.php
+++ b/public_html/lists/admin/admin.php
@@ -115,6 +115,7 @@
 }
 
 if (!empty($_GET['delete'])) {
+    verifyCsrfGetToken();
     $delete = sprintf('%d', $_GET['delete']);
     // delete the index in delete
     echo s('Deleting')." $delete ..\n";
diff --git a/public_html/lists/admin/admins.php b/public_html/lists/admin/admins.php
index 720b1363c..1baeeab1c 100644
--- a/public_html/lists/admin/admins.php
+++ b/public_html/lists/admin/admins.php
@@ -40,6 +40,7 @@
 echo '<div class="pull-right fright">'.PageLinkActionButton('admin', s('Add new admin'), "start=$start".$remember_find).'</div><div class="clearfix"></div>';
 
 if (isset($_GET['delete']) && $_GET['delete']) {
+    verifyCsrfGetToken();
     // delete the index in delete
     if ($_GET['delete'] == $_SESSION['logindetails']['id']) {
         echo s('You cannot delete yourself')."\n";
diff --git a/public_html/lists/admin/bouncerule.php b/public_html/lists/admin/bouncerule.php
index 6e1114376..dcbffedcd 100644
--- a/public_html/lists/admin/bouncerule.php
+++ b/public_html/lists/admin/bouncerule.php
@@ -11,6 +11,7 @@
 }
 
 if (isset($_GET['action']) && $_GET['action'] == 'next') {
+    verifyCsrfGetToken();
     if (isset($_GET['del'])) {
         Sql_Query(sprintf('delete from %s where id = %d', $GLOBALS['tables']['bounceregex'], $_GET['del']));
     } elseif (isset($_GET['activate'])) {
diff --git a/public_html/lists/admin/bouncerules.php b/public_html/lists/admin/bouncerules.php
index f848fd29b..a7c5906a7 100644
--- a/public_html/lists/admin/bouncerules.php
+++ b/public_html/lists/admin/bouncerules.php
@@ -41,6 +41,7 @@
 }
 
 if (isset($_GET['del']) && $_GET['del']) {
+    verifyCsrfGetToken();
     Sql_Query(sprintf('delete from %s where id = %d', $GLOBALS['tables']['bounceregex'], $_GET['del']));
     Redirect('bouncerules'.$url);
 }