Security: enforce CSRF tokens on state-changing admin endpoints

Several admin endpoints read $_POST and executed privileged state changes
(course export/import, user-to-URL assignment, course-to-HR-manager
assignment, session-to-promotion subscription) without any anti-CSRF token
validation, so forged cross-site POSTs were accepted.

Add the standard Chamilo legacy idiom to each: reject the request with
api_not_allowed() when Security::check_token('post') fails, and emit a
per-session token on the form (sec_token hidden via FormValidator, or
Security::get_HTML_token() inside the hand-written forms).

Refs GHSA-cxxm-wpv8-fwh9

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: AngelFQC

public/main/admin/access_url_add_users_to_url.php

@@ -47,6 +47,9 @@
 Display::page_subheader2($tool_name);
 
 if (!empty($_POST['form_sent'])) {
+    if (!Security::check_token('post')) {
+        api_not_allowed(true);
+    }
     $form_sent = $_POST['form_sent'];
     $users = isset($_POST['user_list']) && is_array($_POST['user_list']) ? array_map('intval', $_POST['user_list']) : [];
     $url_list = isset($_POST['url_list']) && is_array($_POST['url_list']) ? $_POST['url_list'] : [];
@@ -99,6 +102,7 @@
 
     <form name="formulaire" method="post" action="<?php echo api_get_self(); ?>" class="space-y-6" onsubmit="return confirmSubmission(event)">
     <input type="hidden" name="form_sent" value="1" />
+    <?php echo Security::get_HTML_token(); ?>
         <div class="flex flex-col sm:flex-row items-center justify-between gap-4">
             <div>
                 <label class="block text-sm font-medium text-gray-700 mb-1">

public/main/admin/add_sessions_to_promotion.php

@@ -71,6 +71,9 @@ function validate_filter() {
 $promotion = new Promotion();
 $id = (int) ($_GET['id']);
 if (isset($_POST['form_sent']) && $_POST['form_sent']) {
+    if (!Security::check_token('post')) {
+        api_not_allowed(true);
+    }
     $form_sent = $_POST['form_sent'];
     $session_in_promotion_posted = $_POST['session_in_promotion_name'];
     if (!is_array($session_in_promotion_posted)) {
@@ -135,6 +138,7 @@ function validate_filter() {
 echo Display::input('hidden', 'id', $id);
 echo Display::input('hidden', 'form_sent', '1');
 echo Display::input('hidden', 'add_type', null);
+echo Security::get_HTML_token();
 ?>
 
 <table border="0" cellpadding="5" cellspacing="0" width="100%">

public/main/admin/course_export.php

@@ -30,6 +30,9 @@
 $courses = $selected_courses = [];
 
 if (isset($_POST['formSent']) && $_POST['formSent']) {
+    if (!Security::check_token('post')) {
+        api_not_allowed(true);
+    }
     $formSent = $_POST['formSent'];
     $select_type = (int) ($_POST['select_type']);
     $file_type = $_POST['file_type'];
@@ -125,6 +128,7 @@
 $form = new FormValidator('export', 'post', api_get_self());
 $form->addHeader($tool_name);
 $form->addHidden('formSent', 1);
+$form->addHidden('sec_token', Security::get_token());
 $form->addElement(
     'radio',
     'select_type',

public/main/admin/course_import.php

@@ -187,6 +187,9 @@ function parse_csv_courses_data($file)
 Display::display_header($tool_name);
 
 if (isset($_POST['formSent']) && $_POST['formSent']) {
+    if (!Security::check_token('post')) {
+        api_not_allowed(true);
+    }
     if (empty($_FILES['import_file']['tmp_name'])) {
         $error_message = get_lang('The file upload has failed.');
         echo Display::return_message($error_message, 'error', false);
@@ -239,6 +242,7 @@ function parse_csv_courses_data($file)
 $form->addElement('checkbox', 'add_me_as_teacher', null, get_lang('Add me as teacher in the imported courses.'));
 $form->addButtonImport(get_lang('Import'), 'save');
 $form->addElement('hidden', 'formSent', 1);
+$form->addHidden('sec_token', Security::get_token());
 $form->display();
 
 $content = '

public/main/admin/dashboard_add_courses_to_user.php

@@ -162,6 +162,9 @@ function remove_item(origin) {
 
 $msg = '';
 if (isset($_POST['formSent']) && 1 == (int) ($_POST['formSent'])) {
+    if (!Security::check_token('post')) {
+        api_not_allowed(true);
+    }
     $courses_list = isset($_POST['CoursesList']) ? $_POST['CoursesList'] : [];
     $affected_rows = CourseManager::subscribeCoursesToDrhManager($user_id, $courses_list);
     if ($affected_rows) {
@@ -225,6 +228,7 @@ function remove_item(origin) {
 ?>
 <form name="formulaire" method="post" action="<?php echo api_get_self(); ?>?user=<?php echo $user_id; ?>" style="margin:0px;">
 <input type="hidden" name="formSent" value="1" />
+<?php echo Security::get_HTML_token(); ?>
 <?php
 if (!empty($msg)) {
     echo Display::return_message($msg, 'normal'); //main API