Version 4.5.0

applications/core/modules/admin/discovery/streams.php

@@ -11,7 +11,7 @@
 namespace IPS\core\modules\admin\discovery;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -22,6 +22,11 @@ if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
  */
 class _streams extends \IPS\Node\Controller
 {
+	/**
+	 * @brief	Has been CSRF-protected
+	 */
+	public static $csrfProtected = TRUE;
+	
 	/**
 	 * Node Class
 	 */
@@ -55,7 +60,8 @@ class _streams extends \IPS\Node\Controller
 			'rebuildDefault'	=> array(
 				'title'		=> 'restore_default_streams',
 				'icon'		=> 'cog',
-				'link'		=> \IPS\Http\Url::internal( 'app=core&module=discovery&controller=streams&do=restoreDefaultStreams' )
+				'link'		=> \IPS\Http\Url::internal( 'app=core&module=discovery&controller=streams&do=restoreDefaultStreams' )->csrf(),
+				'data'		=> array( 'confirm' => '', 'confirmMessage' => \IPS\Member::loggedIn()->language()->addToStack('restore_default_streams_confirm') )
 			),
 		);
 		
@@ -69,6 +75,8 @@ class _streams extends \IPS\Node\Controller
 	 */
 	protected function restoreDefaultStreams()
 	{
+		\IPS\Session::i()->csrfCheck();
+		
 		$schema	= json_decode( file_get_contents( \IPS\ROOT_PATH . "/applications/core/data/schema.json" ), TRUE );
 		
 		/* Get the default language strings */
@@ -159,7 +167,7 @@ class _streams extends \IPS\Node\Controller
 			$toSave = array();
 			foreach ( $types as $k )
 			{
-				$toSave[ "all_activity_{$k}" ] = intval( in_array( $k, $values['all_activity_extra_stream'] ) );
+				$toSave[ "all_activity_{$k}" ] = \intval( \in_array( $k, $values['all_activity_extra_stream'] ) );
 			}
 
 			$toSave[ 'activity_stream_rss' ] = $values['activity_stream_rss'];