Convert lock topic to post request

#2033
NamelessMC · Aug 26, 2021 · d36a28a · d36a28a
1 parent 03775d1
commit d36a28a
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/custom/templates/DefaultRevamp/forum/view_topic.tpl b/custom/templates/DefaultRevamp/forum/view_topic.tpl
@@ -61,12 +61,15 @@
     <a class="ui small primary button" href="{$FOLLOW_URL}">{$FOLLOW}</a>
   {/if}
   {if isset($CAN_MODERATE)}
+    <form action="{$LOCK_URL}" method="post" id="lockPost" style="display: none">
+      <input type="hidden" value="{$TOKEN}" name="token" />
+    </form>
     <div class="ui top right pointing dropdown small primary button">
       <span class="text">{$MOD_ACTIONS}</span>
       <i class="dropdown icon"></i>
       <div class="menu">
         <div class="header">{$MOD_ACTIONS}</div>
-        <a class="item" href="{$LOCK_URL}">{$LOCK}</a>
+        <a type="submit" class="item" onclick="document.getElementById('lockPost').submit()">{$LOCK}</a>
         <a class="item" href="{$MERGE_URL}">{$MERGE}</a>
         <a class="item" data-toggle="modal" data-target="#modal-delete">{$DELETE}</a>
         <a class="item" href="{$MOVE_URL}">{$MOVE}</a>

diff --git a/modules/Forum/pages/forum/lock.php b/modules/Forum/pages/forum/lock.php
@@ -28,6 +28,12 @@
         die();
     }
 
+    if (!isset($_POST['token']) || !Token::check($_POST['token'])) {
+        Session::flash('failure_post', $language->get('general', 'invalid_token'));
+        Redirect::to(URL::build('/forum/topic/' . $topic_id));
+        die();
+    }
+
     $forum_id = $topic[0]->forum_id;
 
     if ($forum->canModerateForum($forum_id, $user->getAllGroupIds())) {