Version 3.4.8

upload/admin/applications/members/modules_public/profile/photo.php

@@ -3,9 +3,9 @@
 /**
  * <pre>
  * Invision Power Services
- * IP.Board v3.4.6
+ * IP.Board v3.4.8
  * Profile Photo
- * Last Updated: $Date: 2012-06-06 06:31:40 -0400 (Wed, 06 Jun 2012) $
+ * Last Updated: $Date: 2015-02-18 08:20:59 -0500 (Wed, 18 Feb 2015) $
  * </pre>
  *
  * @author 		$Author: AndyMillne $
@@ -15,7 +15,7 @@
  * @subpackage	Members
  * @link		http://www.invisionpower.com
  * @since		20th February 2002
- * @version		$Revision: 10874 $
+ * @version		$Revision: 12598 $
  *
  */
 
@@ -73,6 +73,11 @@ class public_members_profile_photo extends ipsCommand
 	 */
 	protected function _remove()
 	{
+		if ( $this->request['secure_key'] != $this->member->form_hash  )
+		{
+			$this->registry->getClass('output')->showError( 'no_permission', 20314.1, null, null, 403 );
+		}
+
 		$this->photo->remove( $this->memberData['member_id'] );
 		
 		/* redirect to show */
@@ -86,6 +91,11 @@ class public_members_profile_photo extends ipsCommand
 	 */
 	protected function _save()
 	{
+		if ( $this->request['secure_key'] != $this->member->form_hash  )
+		{
+			$this->registry->getClass('output')->showError( 'no_permission', 20314.1, null, null, 403 );
+		}
+		
 		$getJson     = intval( $this->request['getJson'] );
 		$photoType   = $this->request['photoType'];
 		$gravatar	 = $this->request['gravatar'];