Convert stick topic to post request

#2033
NamelessMC · Aug 28, 2021 · fed9214 · fed9214
1 parent 5766cb9
commit fed9214
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 4 deletions.
diff --git a/custom/templates/DefaultRevamp/forum/view_topic.tpl b/custom/templates/DefaultRevamp/forum/view_topic.tpl
@@ -61,19 +61,22 @@
     <a class="ui small primary button" href="{$FOLLOW_URL}">{$FOLLOW}</a>
   {/if}
   {if isset($CAN_MODERATE)}
-    <form action="{$LOCK_URL}" method="post" id="lockPost" style="display: none">
+    <form action="{$LOCK_URL}" method="post" id="lockTopic" style="display: none">
+      <input type="hidden" value="{$TOKEN}" name="token" />
+    </form>
+    <form action="{$STICK_URL}" method="post" id="stickTopic" style="display: none">
       <input type="hidden" value="{$TOKEN}" name="token" />
     </form>
     <div class="ui top right pointing dropdown small primary button">
       <span class="text">{$MOD_ACTIONS}</span>
       <i class="dropdown icon"></i>
       <div class="menu">
         <div class="header">{$MOD_ACTIONS}</div>
-        <a type="submit" class="item" onclick="document.getElementById('lockPost').submit()">{$LOCK}</a>
+        <a type="submit" class="item" onclick="document.getElementById('lockTopic').submit()">{$LOCK}</a>
         <a class="item" href="{$MERGE_URL}">{$MERGE}</a>
         <a class="item" data-toggle="modal" data-target="#modal-delete">{$DELETE}</a>
         <a class="item" href="{$MOVE_URL}">{$MOVE}</a>
-        <a class="item" href="{$STICK_URL}">{$STICK}</a>
+        <a type="submit" class="item" onclick="document.getElementById('stickTopic').submit()">{$STICK}</a>
       </div>
     </div>
   {/if}

diff --git a/modules/Forum/pages/forum/stick.php b/modules/Forum/pages/forum/stick.php
@@ -2,7 +2,7 @@
 /*
  *	Made by Samerton
  *  https://github.com/NamelessMC/Nameless/
- *  NamelessMC version 2.0.0-pr8
+ *  NamelessMC version 2.0.0-pr12
  *
  *  License: MIT
  *
@@ -39,6 +39,12 @@
     die();
 }
 
+if (!isset($_POST['token']) || !Token::check($_POST['token'])) {
+    Session::flash('failure_post', $language->get('general', 'invalid_token'));
+    Redirect::to(URL::build('/forum/topic/' . $topic_id));
+    die();
+}
+
 $forum_id = $topic[0]->forum_id;
 
 if ($forum->canModerateForum($forum_id, $user->getAllGroupIds())) {