Version 4.5.0

applications/nexus/modules/admin/support/severities.php

@@ -12,7 +12,7 @@
 namespace IPS\nexus\modules\admin\support;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -23,6 +23,11 @@ if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
  */
 class _severities extends \IPS\Node\Controller
 {
+	/**
+	 * @brief	Has been CSRF-protected
+	 */
+	public static $csrfProtected = TRUE;
+	
 	/**
 	 * Node Class
 	 */
@@ -50,6 +55,7 @@ class _severities extends \IPS\Node\Controller
 		
 		if ( isset( \IPS\Request::i()->nexus_severities ) )
 		{
+			\IPS\Session::i()->csrfCheck();
 			\IPS\Settings::i()->changeValues( array( 'nexus_severities' => \IPS\Request::i()->nexus_severities ) );
 			\IPS\Session::i()->log( 'acplogs__severity_settings' );
 			\IPS\Output::i()->redirect( \IPS\Http\Url::internal('app=nexus&module=support&controller=settings&tab=severities') );