From d36a28ac63648ab0e4eed421cdd3c0a2756c1a2c Mon Sep 17 00:00:00 2001
From: samerton <samerton@users.noreply.github.com>
Date: Thu, 26 Aug 2021 17:16:57 +0100
Subject: [PATCH] Convert lock topic to post request #2033

---
 custom/templates/DefaultRevamp/forum/view_topic.tpl | 5 ++++-
 modules/Forum/pages/forum/lock.php                  | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/custom/templates/DefaultRevamp/forum/view_topic.tpl b/custom/templates/DefaultRevamp/forum/view_topic.tpl
index bc82240f50..449b222a4a 100755
--- a/custom/templates/DefaultRevamp/forum/view_topic.tpl
+++ b/custom/templates/DefaultRevamp/forum/view_topic.tpl
@@ -61,12 +61,15 @@
     <a class="ui small primary button" href="{$FOLLOW_URL}">{$FOLLOW}</a>
   {/if}
   {if isset($CAN_MODERATE)}
+    <form action="{$LOCK_URL}" method="post" id="lockPost" style="display: none">
+      <input type="hidden" value="{$TOKEN}" name="token" />
+    </form>
     <div class="ui top right pointing dropdown small primary button">
       <span class="text">{$MOD_ACTIONS}</span>
       <i class="dropdown icon"></i>
       <div class="menu">
         <div class="header">{$MOD_ACTIONS}</div>
-        <a class="item" href="{$LOCK_URL}">{$LOCK}</a>
+        <a type="submit" class="item" onclick="document.getElementById('lockPost').submit()">{$LOCK}</a>
         <a class="item" href="{$MERGE_URL}">{$MERGE}</a>
         <a class="item" data-toggle="modal" data-target="#modal-delete">{$DELETE}</a>
         <a class="item" href="{$MOVE_URL}">{$MOVE}</a>
diff --git a/modules/Forum/pages/forum/lock.php b/modules/Forum/pages/forum/lock.php
index 1a1c13715e..f3b8a40097 100644
--- a/modules/Forum/pages/forum/lock.php
+++ b/modules/Forum/pages/forum/lock.php
@@ -28,6 +28,12 @@
         die();
     }
 
+    if (!isset($_POST['token']) || !Token::check($_POST['token'])) {
+        Session::flash('failure_post', $language->get('general', 'invalid_token'));
+        Redirect::to(URL::build('/forum/topic/' . $topic_id));
+        die();
+    }
+
     $forum_id = $topic[0]->forum_id;
 
     if ($forum->canModerateForum($forum_id, $user->getAllGroupIds())) {