Project

General

Profile

Actions
Copy link

Todo #16961

closed

"Wake All" functionality on ``services_wol.php`` should only use POST

Added by Jim Pingle 23 days ago. Updated 4 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Wake on LAN
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default

Description

The services_wol.php page allows a wakeall request to be submitted via GET and via POST, but it should only use POST for consistency and so that it has proper CSRF protection.

There are two sets of buttons on the page which allow the user to take this action, but they unnecessarily use different methods to submit the request. The first button uses GET, the second uses POST but does so with a dedicated bit of JavaScript. Neither method is the current proper approach.

If the link is changed as follows it will use POST and have a confirmation dialog:

<a href="services_wol.php?wakeall=true" role="button" class="btn btn-primary do-confirm" usepost>

The same method can be used for both buttons, the extra JavaScript block can then be removed.

Files

16961.patch (1.51 KB) 16961.patch Jim Pingle, 07/20/2026 06:39 PM
Actions
Copy link
 #1

Updated by Jim Pingle 23 days ago

Fixed in commit db4b79bfbcef4687039d4a65df64bd6118984d00

Patch is attached.

Actions
Copy link
 #2

Updated by Christopher Cope 4 days ago

  • Status changed from Feedback to Resolved

This is applied and working as expected on

26.07-RELEASE (amd64)
built on Fri Aug 7 19:26:00 UTC 2026
FreeBSD 16.0-CURRENT

Marking resolved.

Actions
Copy link

Also available in: Atom PDF