Version 4.1.19

applications/core/modules/front/system/vse.php

@@ -2,9 +2,9 @@
 /**
  * @brief		Visual Theme Editor
  * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
- * @copyright	(c) 2001 - SVN_YYYY Invision Power Services, Inc.
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
  * @license		http://www.invisionpower.com/legal/standards/
- * @package		IPS Social Suite
+ * @package		IPS Community Suite
  * @since		7 Nov 2013
  * @version		SVN_VERSION_NUMBER
  */
@@ -144,6 +144,8 @@ class _vse extends \IPS\Dispatcher\Controller
 	 */
 	public function close()
 	{
+		\IPS\Session::i()->csrfCheck();
+
 		/* Update the current member */
 		\IPS\Member::loggedIn()->members_bitoptions['bw_using_skin_gen'] = 0;
 		\IPS\Member::loggedIn()->save();
@@ -179,6 +181,8 @@ class _vse extends \IPS\Dispatcher\Controller
 		{
 			\IPS\Output::i()->json( 'NO_PERMISSION', 403 );
 		}
+
+		\IPS\Session::i()->csrfCheck();
 		
 		$theme = null;
 		
@@ -199,7 +203,7 @@ class _vse extends \IPS\Dispatcher\Controller
 						
 		$theme->vseSave( \IPS\Request::i()->css, \IPS\Request::i()->customcss, \IPS\Request::i()->settings, \IPS\Request::i()->values );
 		
-		\IPS\File::getClass('core_Theme')->deleteContainer( 'css_built_' . $this->id );
+		\IPS\File::getClass('core_Theme')->deleteContainer( 'css_built_' . $theme->id );
 		$theme->css_map = array();
 		$theme->save();
 		foreach( $theme->children() as $child )