Version 4.5.0

applications/nexus/modules/admin/support/incomingemail.php

@@ -12,7 +12,7 @@
 namespace IPS\nexus\modules\admin\support;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -23,6 +23,11 @@ if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
  */
 class _incomingemail extends \IPS\Dispatcher\Controller
 {
+	/**
+	 * @brief	Has been CSRF-protected
+	 */
+	public static $csrfProtected = TRUE;
+	
 	/**
 	 * Execute
 	 *
@@ -110,7 +115,7 @@ class _incomingemail extends \IPS\Dispatcher\Controller
 				{
 					$task = \IPS\Db::i()->select( '*', 'core_tasks', array( 'app=? AND `key`=? AND enabled=1', 'core', 'pop' ) )->first();
 					$pop3Form = $this->_pop3();
-					$pop3Form->addButton( 'disable_pop3', 'link', \IPS\Http\Url::internal( 'app=nexus&module=support&controller=incomingemail&do=disablePop3' ), '', array( 'data-confirm' => '' ) );
+					$pop3Form->addButton( 'disable_pop3', 'link', \IPS\Http\Url::internal( 'app=nexus&module=support&controller=incomingemail&do=disablePop3' )->csrf(), '', array( 'data-confirm' => '' ) );
 					$content = \IPS\Theme::i()->getTemplate('incomingemailsetup')->usingpop3( $pop3Form, (string) $table );
 				}
 				catch ( \UnderflowException $e ) { }
@@ -130,6 +135,7 @@ class _incomingemail extends \IPS\Dispatcher\Controller
 	 */
 	protected function disablePop3()
 	{
+		\IPS\Session::i()->csrfCheck();
 		\IPS\Settings::i()->changeValues( array( 'pop3_server' => '', 'pop3_port' => '', 'pop3_user' => '', 'pop3_password' => '' ) );		
 		\IPS\Session::i()->log( 'acplogs__pop3_settings' );
 		\IPS\Db::i()->update( 'core_tasks', array( 'enabled' => 0 ), array( 'app=? AND `key`=?', 'core', 'pop' ) );