From 6dd1d5097c8c3963facee6dc8bbe1cb62a18995b Mon Sep 17 00:00:00 2001
From: samerton <samerton@users.noreply.github.com>
Date: Sat, 28 Aug 2021 15:32:02 +0100
Subject: [PATCH] Convert follow topic to post request #2033

---
 .../DefaultRevamp/forum/view_topic.tpl        | 10 ++++-
 modules/Forum/pages/forum/view_topic.php      | 44 ++++++++++---------
 2 files changed, 31 insertions(+), 23 deletions(-)

diff --git a/custom/templates/DefaultRevamp/forum/view_topic.tpl b/custom/templates/DefaultRevamp/forum/view_topic.tpl
index 19ee969809..533b2ec1f4 100755
--- a/custom/templates/DefaultRevamp/forum/view_topic.tpl
+++ b/custom/templates/DefaultRevamp/forum/view_topic.tpl
@@ -56,9 +56,15 @@
       
 <div class="res right floated">
   {if isset($UNFOLLOW)}
-    <a class="ui small primary button" href="{$UNFOLLOW_URL}">{$UNFOLLOW}</a>
+    <form action="{$UNFOLLOW_URL}" method="post" style="display: inline">
+      <input type="hidden" value="{$TOKEN}" name="token" />
+      <button class="ui small primary button">{$UNFOLLOW}</button>
+    </form>
   {elseif isset($FOLLOW)}
-    <a class="ui small primary button" href="{$FOLLOW_URL}">{$FOLLOW}</a>
+    <form action="{$FOLLOW_URL}" method="post" style="display: inline">
+      <input type="hidden" value="{$TOKEN}" name="token" />
+      <button class="ui small primary button">{$FOLLOW}</button>
+    </form>
   {/if}
   {if isset($CAN_MODERATE)}
     <form action="{$LOCK_URL}" method="post" id="lockTopic" style="display: none">
diff --git a/modules/Forum/pages/forum/view_topic.php b/modules/Forum/pages/forum/view_topic.php
index 4cc20cdf98..93e1ca1efe 100644
--- a/modules/Forum/pages/forum/view_topic.php
+++ b/modules/Forum/pages/forum/view_topic.php
@@ -120,27 +120,29 @@
 // Follow/unfollow
 if (isset($_GET['action'])) {
     if ($user->isLoggedIn()) {
-        switch ($_GET['action']) {
-            case 'follow':
-                $already_following = DB::getInstance()->query('SELECT id FROM nl2_topics_following WHERE topic_id = ? AND user_id = ?', array($tid, $user->data()->id));
-                if (!$already_following->count()) {
-                    $queries->create('topics_following', array(
-                        'topic_id' => $tid,
-                        'user_id' => $user->data()->id,
-                        'existing_alerts' => 0
-                    ));
-                    Session::flash('success_post', $forum_language->get('forum', 'now_following_topic'));
-                }
-                break;
-            case 'unfollow':
-                $delete = DB::getInstance()->createQuery('DELETE FROM nl2_topics_following WHERE topic_id = ? AND user_id = ?', array($tid, $user->data()->id));
-                Session::flash('success_post', $forum_language->get('forum', 'no_longer_following_topic'));
-                if (isset($_GET['return']) && $_GET['return'] == 'list') {
-                    Redirect::to(URL::build('/user/following_topics'));
-                    die();
-                }
-                break;
-        }
+        if (Token::check($_POST['token'])) {
+            switch ($_GET['action']) {
+                case 'follow':
+                    $already_following = DB::getInstance()->query('SELECT id FROM nl2_topics_following WHERE topic_id = ? AND user_id = ?', array($tid, $user->data()->id));
+                    if (!$already_following->count()) {
+                        $queries->create('topics_following', array(
+                            'topic_id' => $tid,
+                            'user_id' => $user->data()->id,
+                            'existing_alerts' => 0
+                        ));
+                        Session::flash('success_post', $forum_language->get('forum', 'now_following_topic'));
+                    }
+                    break;
+                case 'unfollow':
+                    $delete = DB::getInstance()->createQuery('DELETE FROM nl2_topics_following WHERE topic_id = ? AND user_id = ?', array($tid, $user->data()->id));
+                    Session::flash('success_post', $forum_language->get('forum', 'no_longer_following_topic'));
+                    if (isset($_GET['return']) && $_GET['return'] == 'list') {
+                        Redirect::to(URL::build('/user/following_topics'));
+                        die();
+                    }
+                    break;
+            }
+        } else Session::flash('failure_post', $language->get('general', 'invalid_token'));
     }
 
     Redirect::to(URL::build('/forum/topic/' . $tid . '-' . $forum->titleToURL($topic->topic_title)));