Version 4.5.0

applications/cms/modules/admin/databases/fields.php

@@ -12,7 +12,7 @@
 namespace IPS\cms\modules\admin\databases;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -23,6 +23,11 @@ if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
  */
 class _fields extends \IPS\Node\Controller
 {
+	/**
+	 * @brief	Has been CSRF-protected
+	 */
+	public static $csrfProtected = TRUE;
+	
 	/**
 	 * Node Class
 	 */
@@ -130,6 +135,8 @@ class _fields extends \IPS\Node\Controller
 	 */
 	public function enableToggle()
 	{
+		\IPS\Session::i()->csrfCheck();
+		
 		$class = '\IPS\cms\Fields' . \IPS\Request::i()->database_id;
 		
 		$class::setFixedFieldVisibility( \IPS\Request::i()->id, (boolean) \IPS\Request::i()->status );
@@ -152,6 +159,8 @@ class _fields extends \IPS\Node\Controller
 	 */
 	public function setAsTitle()
 	{
+		\IPS\Session::i()->csrfCheck();
+		
 		$class    = '\IPS\cms\Fields' . \IPS\Request::i()->database_id;
 		$database = \IPS\cms\Databases::load( \IPS\Request::i()->database_id );
 
@@ -180,6 +189,8 @@ class _fields extends \IPS\Node\Controller
 	 */
 	public function setAsContent()
 	{
+		\IPS\Session::i()->csrfCheck();
+		
 		$class    = '\IPS\cms\Fields' . \IPS\Request::i()->database_id;
 		$database = \IPS\cms\Databases::load( \IPS\Request::i()->database_id );
 
@@ -236,7 +247,7 @@ class _fields extends \IPS\Node\Controller
 			$matrix->columns[ $k ] = function( $key, $value, $data ) use ( $perms, $k, $v )
 			{
 				$groupId = mb_substr( $key, 0, -( 2 + mb_strlen( $k ) ) );
-				return new \IPS\Helpers\Form\Checkbox( $key, isset( $perms[ "perm_{$v}" ] ) and ( $perms[ "perm_{$v}" ] === '*' or in_array( $groupId, explode( ',', $perms[ "perm_{$v}" ] ) ) ) );
+				return new \IPS\Helpers\Form\Checkbox( $key, isset( $perms[ "perm_{$v}" ] ) and ( $perms[ "perm_{$v}" ] === '*' or \in_array( $groupId, explode( ',', $perms[ "perm_{$v}" ] ) ) ) );
 			};
 			$matrix->checkAlls[ $k ] = ( $perms[ "perm_{$v}" ] === '*' );
 		}
@@ -276,7 +287,7 @@ class _fields extends \IPS\Node\Controller
 			{
 				foreach ( $permMap as $k => $v )
 				{
-					if ( isset( $perms[ $k ] ) and $perms[ $k ] and is_array( $_perms[ $v ] ) )
+					if ( isset( $perms[ $k ] ) and $perms[ $k ] and \is_array( $_perms[ $v ] ) )
 					{
 						$_perms[ $v ][] = $group;
 					}
@@ -286,7 +297,7 @@ class _fields extends \IPS\Node\Controller
 			/* Finalise */
 			foreach ( $_perms as $k => $v )
 			{
-				$save[ "perm_{$k}" ] = is_array( $v ) ? implode( $v, ',' ) : $v;
+				$save[ "perm_{$k}" ] = \is_array( $v ) ? implode( ',', $v ) : $v;
 			}
 			
 			$class::setFixedFieldPermissions( \IPS\Request::i()->field, $save );