Version 4.5.0

applications/core/modules/admin/members/devices.php

@@ -11,7 +11,7 @@
 namespace IPS\core\modules\admin\members;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -22,6 +22,11 @@ if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
  */
 class _devices extends \IPS\Dispatcher\Controller
 {
+	/**
+	 * @brief	Has been CSRF-protected
+	 */
+	public static $csrfProtected = TRUE;
+	
 	/**
 	 * Execute
 	 *
@@ -71,7 +76,17 @@ class _devices extends \IPS\Dispatcher\Controller
 		
 		if ( $activeTab === 'info' )
 		{
-			$activeTabContents = \IPS\Theme::i()->getTemplate( 'members' )->deviceInfo( $device );
+			$oauthClients = \IPS\Api\OAuthClient::roots();
+			$apps = array();
+			foreach ( \IPS\Db::i()->select( '*', 'core_oauth_server_access_tokens', array( 'member_id=? AND device_key=?', \IPS\Member::loggedIn()->member_id, $device->device_key ), 'issued DESC' ) as $accessToken )
+			{
+				if ( isset( $oauthClients[ $accessToken['client_id'] ] ) )
+				{
+					$apps[] = $accessToken;
+				}
+			}
+			
+			$activeTabContents = \IPS\Theme::i()->getTemplate( 'members' )->deviceInfo( $device, $apps, $oauthClients );
 		}
 		elseif ( $activeTab === 'member' )
 		{
@@ -156,7 +171,7 @@ class _devices extends \IPS\Dispatcher\Controller
 				\IPS\Output::i()->sidebar['actions']['deauthorize'] = array(
 					'icon'		=> 'times',
 					'title'		=> 'sign_out',
-					'link'		=> \IPS\Http\Url::internal( "app=core&module=members&controller=devices&do=deauthorize" )->setQueryString( array( 'device' => $device->device_key, 'member' => $member->member_id, 'r' => 'device' ) )
+					'link'		=> \IPS\Http\Url::internal( "app=core&module=members&controller=devices&do=deauthorize" )->setQueryString( array( 'device' => $device->device_key, 'member' => $member->member_id, 'r' => 'device' ) )->csrf()
 				);
 			}
 			
@@ -223,7 +238,7 @@ class _devices extends \IPS\Dispatcher\Controller
 					'link'	=> \IPS\Http\Url::internal( 'app=core&module=members&controller=devices&do=deauthorize' )->setQueryString( array(
 						'device'	=> $row['device_key'],
 						'member'	=> $row['member_id']
-					) ),
+					) )->csrf(),
 				);
 			}
 			
@@ -244,7 +259,9 @@ class _devices extends \IPS\Dispatcher\Controller
 	 * @return	void
 	 */
 	protected function deauthorize()
-	{		
+	{
+		\IPS\Session::i()->csrfCheck();
+		
 		try
 		{
 			$member = \IPS\Member::load( \IPS\Request::i()->member );
@@ -252,6 +269,8 @@ class _devices extends \IPS\Dispatcher\Controller
 			$device->login_key = NULL;
 			$device->save();
 			
+			\IPS\Db::i()->delete( 'core_oauth_server_access_tokens', array( 'member_id=? AND device_key=?', $device->member_id, $device->device_key ) );
+			
 			$member->logHistory( 'core', 'login', array( 'type' => 'logout', 'device' => $device->device_key ) );
 			\IPS\Session::i()->log( 'acplog__members_disabled_autologin', array( $member->name => FALSE ) );