Security: No ACL/CSRF check on CSV export #104

New Issue

2026-05-29T05:30:34Z

jmiller commented

2026-05-29 05:30:34 +00:00

Audit Finding L-4

Severity: Low

Issue:
PostsController::exportCsv() has no $this->checkToken() and no authorise() check. Any authenticated backend user who can access the component can export all posts.

Fix: Add $this->checkToken('get') and ACL check.

Files: PostsController.php

Label: priority: low, type: security

## Audit Finding L-4 **Severity:** Low **Issue:** `PostsController::exportCsv()` has no `$this->checkToken()` and no `authorise()` check. Any authenticated backend user who can access the component can export all posts. **Fix:** Add `$this->checkToken('get')` and ACL check. **Files:** `PostsController.php` **Label:** `priority: low`, `type: security`

jmiller commented

2026-05-29 05:30:37 +00:00

Branch created: feature/104-security-no-acl-csrf-check-on-csv-export

git fetch origin
git checkout feature/104-security-no-acl-csrf-check-on-csv-export

Branch created: [`feature/104-security-no-acl-csrf-check-on-csv-export`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/104-security-no-acl-csrf-check-on-csv-export) ```bash git fetch origin git checkout feature/104-security-no-acl-csrf-check-on-csv-export ```

Sign in to join this conversation.

Type Security

Status —

Priority High

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#104