aboutsummaryrefslogtreecommitdiffstats
path: root/phpBB/includes
diff options
context:
space:
mode:
authorMarc Alexander <admin@m-a-styles.de>2020-01-04 14:19:57 +0100
committerMarc Alexander <admin@m-a-styles.de>2020-01-04 14:19:57 +0100
commited9cbc89c19bc6321bfdd540f241683b71ea9a6e (patch)
treef7a19b771025e29522b4b6cf7b2c4591da89a30e /phpBB/includes
parentfcca5c5b582c43353be73ae50afb631e51407bbf (diff)
parent2fdd46b36431ae0f58bb2e78e42553168db9a0ff (diff)
downloadforums-ed9cbc89c19bc6321bfdd540f241683b71ea9a6e.tar
forums-ed9cbc89c19bc6321bfdd540f241683b71ea9a6e.tar.gz
forums-ed9cbc89c19bc6321bfdd540f241683b71ea9a6e.tar.bz2
forums-ed9cbc89c19bc6321bfdd540f241683b71ea9a6e.tar.xz
forums-ed9cbc89c19bc6321bfdd540f241683b71ea9a6e.zip
Merge branch 'prep-release-3.2.9' into 3.2.x
Diffstat (limited to 'phpBB/includes')
-rw-r--r--phpBB/includes/ucp/ucp_groups.php17
-rw-r--r--phpBB/includes/ucp/ucp_pm.php7
-rw-r--r--phpBB/includes/ucp/ucp_pm_viewfolder.php7
3 files changed, 25 insertions, 6 deletions
diff --git a/phpBB/includes/ucp/ucp_groups.php b/phpBB/includes/ucp/ucp_groups.php
index 2423af86be..cf6e049748 100644
--- a/phpBB/includes/ucp/ucp_groups.php
+++ b/phpBB/includes/ucp/ucp_groups.php
@@ -534,7 +534,12 @@ class ucp_groups
'teampage' => $group_row['group_teampage'],
);
- if ($config['allow_avatar'])
+ if (!check_form_key('ucp_groups'))
+ {
+ $error[] = $user->lang['FORM_INVALID'];
+ }
+
+ if (!count($error) && $config['allow_avatar'])
{
// Handle avatar
$driver_name = $phpbb_avatar_manager->clean_driver_name($request->variable('avatar_driver', ''));
@@ -556,11 +561,6 @@ class ucp_groups
$error = array_merge($error, $phpbb_avatar_manager->localize_errors($user, $avatar_error));
}
- if (!check_form_key('ucp_groups'))
- {
- $error[] = $user->lang['FORM_INVALID'];
- }
-
// Validate submitted colour value
if ($colour_error = validate_data($submit_ary, array('colour' => array('hex_colour', true))))
{
@@ -875,6 +875,11 @@ class ucp_groups
trigger_error($user->lang['NO_GROUP'] . $return_page);
}
+ if (!check_form_key('ucp_groups'))
+ {
+ trigger_error($user->lang('FORM_INVALID') . $return_page);
+ }
+
if (!($row = group_memberships($group_id, $user->data['user_id'])))
{
trigger_error($user->lang['NOT_MEMBER_OF_GROUP'] . $return_page);
diff --git a/phpBB/includes/ucp/ucp_pm.php b/phpBB/includes/ucp/ucp_pm.php
index 4d02620e89..00d1ce7149 100644
--- a/phpBB/includes/ucp/ucp_pm.php
+++ b/phpBB/includes/ucp/ucp_pm.php
@@ -193,6 +193,8 @@ class ucp_pm
trigger_error('NO_AUTH_READ_HOLD_MESSAGE');
}
+ add_form_key('ucp_pm_view');
+
// First Handle Mark actions and moving messages
$submit_mark = (isset($_POST['submit_mark'])) ? true : false;
$move_pm = (isset($_POST['move_pm'])) ? true : false;
@@ -207,6 +209,11 @@ class ucp_pm
$submit_mark = false;
}
+ if (($move_pm || $submit_mark) && !check_form_key('ucp_pm_view'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
// Move PM
if ($move_pm)
{
diff --git a/phpBB/includes/ucp/ucp_pm_viewfolder.php b/phpBB/includes/ucp/ucp_pm_viewfolder.php
index 09e7bf4d7c..ce40a2507d 100644
--- a/phpBB/includes/ucp/ucp_pm_viewfolder.php
+++ b/phpBB/includes/ucp/ucp_pm_viewfolder.php
@@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder)
$folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']);
+ add_form_key('ucp_pm_view_folder');
+
if (!$submit_export)
{
$user->add_lang('viewforum');
@@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder)
$enclosure = $request->variable('enclosure', '');
$delimiter = $request->variable('delimiter', '');
+ if (!check_form_key('ucp_pm_view_folder'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === ''))
{
$template->assign_var('PROMPT', true);