Version 5.0.14

applications/core/modules/front/messaging/messenger.php

@@ -32,7 +32,6 @@ use IPS\Notification;
 use IPS\Output;
 use IPS\Request;
 use IPS\Session;
-use IPS\Settings;
 use IPS\Theme;
 use LogicException;
 use OutOfRangeException;
@@ -60,11 +59,6 @@ class messenger extends Controller
 	 */
 	protected static string $contentModel = 'IPS\core\Messenger\Conversation';
 	
-	/**
-	 * [Content\Controller]	FURL Base
-	 */
-	protected static string $furlBase = 'messenger';
-	
 	/**
 	 * Execute
 	 *
@@ -586,9 +580,9 @@ class messenger extends Controller
 				try
 				{
 					$conversation = Conversation::loadAndCheckPerms( $id );
-					$conversation->moveConversation( Request::i()->move_message_to );
+					$conversation->moveConversation( $values['move_message_to'] );
 				}
-				catch ( OutOfRangeException $e )
+				catch ( OutOfRangeException )
 				{
 					continue;
 				}
@@ -762,7 +756,7 @@ class messenger extends Controller
 		try
 		{
 			$conversation = Conversation::loadAndCheckPerms( Request::i()->id );
-			if ( $conversation->starter_id != Member::loggedIn()->member_id )
+			if ( $conversation->starter_id != Member::loggedIn()->member_id or Request::i()->member == $conversation->starter_id )
 			{
 				throw new BadMethodCallException;
 			}
@@ -787,7 +781,7 @@ class messenger extends Controller
 				Output::i()->redirect( $conversation->url() );
 			}
 		}
-		catch ( LogicException $e )
+		catch ( LogicException )
 		{
 			Output::i()->error( 'no_module_permission', '2C137/4', 403, '' );
 		}
@@ -1071,6 +1065,8 @@ class messenger extends Controller
 	 */
 	protected function removeAlertFilter() : void
 	{
+		Session::i()->csrfCheck();
+
 		Alert::clearMessengerFilters();
 
 		Output::i()->redirect( Url::internal('app=core&module=messaging&controller=messenger&overview=1') );