Version 4.3.6

applications/core/modules/front/system/terms.php

@@ -44,6 +44,8 @@ class _terms extends \IPS\Dispatcher\Controller
 	 */
 	protected function dismiss()
 	{
+		\IPS\Session::i()->csrfCheck();
+		
 		\IPS\Request::i()->setCookie( 'guestTermsDismissed', 1, NULL, FALSE );
 
 		if ( \IPS\Request::i()->isAjax() )
@@ -63,7 +65,7 @@ class _terms extends \IPS\Dispatcher\Controller
 					$url = NULL;
 				}
 				
-				if ( $url instanceof \IPS\Http\Url\Internal )
+				if ( $url instanceof \IPS\Http\Url\Internal and !$url->openRedirect() )
 				{
 					\IPS\Output::i()->redirect( $url, 'terms_dismissed' );
 				}