Convert delete topic to post request

#2033
NamelessMC · Aug 28, 2021 · 5766cb9 · 5766cb9
1 parent faca164
commit 5766cb9
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/custom/templates/DefaultRevamp/forum/view_topic.tpl b/custom/templates/DefaultRevamp/forum/view_topic.tpl
@@ -356,7 +356,11 @@
     </div>
     <div class="actions">
       <a class="ui negative button">{$CANCEL}</a>
-      <a class="ui positive button" href="{$DELETE_URL}">{$DELETE}</a>
+
+      <form action="{$DELETE_URL}" method="post" id="deleteTopic" style="display: none">
+        <input type="hidden" value="{$TOKEN}" name="token" />
+      </form>
+      <a type="submit" class="ui positive button" onclick="document.getElementById('deleteTopic').submit()">{$DELETE}</a>
     </div>
   </div>
 {/if}

diff --git a/modules/Forum/pages/forum/delete.php b/modules/Forum/pages/forum/delete.php
@@ -2,7 +2,7 @@
 /*
  *	Made by Samerton
  *  https://github.com/NamelessMC/Nameless/
- *  NamelessMC version 2.0.0-pr8
+ *  NamelessMC version 2.0.0-pr12
  *
  *  License: MIT
  *
@@ -33,7 +33,13 @@
 $topic = $queries->getWhere('topics', array('id', '=', $topic_id));
 
 if (!count($topic)) {
-    Redirect::to(URL::build('forum'));
+    Redirect::to(URL::build('/forum'));
+    die();
+}
+
+if (!isset($_POST['token']) || !Token::check($_POST['token'])) {
+    Session::flash('failure_post', $language->get('general', 'invalid_token'));
+    Redirect::to(URL::build('/forum/topic/' . $topic_id));
     die();
 }