From e8f27f547b061b88ed78232e75e859bdf7ebcd6b Mon Sep 17 00:00:00 2001
From: jekkos <jeroen.peelaerts@gmail.com>
Date: Tue, 28 Sep 2021 23:56:30 +0200
Subject: [PATCH] Extend method hook validation for deletes

---
 application/config/hooks.php      |  4 ++--
 application/hooks/method_hook.php | 16 ++++++++++++++++
 application/hooks/save_hook.php   | 16 ----------------
 3 files changed, 18 insertions(+), 18 deletions(-)
 create mode 100644 application/hooks/method_hook.php
 delete mode 100644 application/hooks/save_hook.php

diff --git a/application/config/hooks.php b/application/config/hooks.php
index 2c868085ff..7f4228ccbb 100644
--- a/application/config/hooks.php
+++ b/application/config/hooks.php
@@ -28,8 +28,8 @@
 
 $hook['pre_controller'][] = array(
     'class'    => '',
-    'function' => 'validate_save',
-    'filename' => 'save_hook.php',
+    'function' => 'validate_method',
+    'filename' => 'method_hook.php',
     'filepath' => 'hooks'
 );
 
diff --git a/application/hooks/method_hook.php b/application/hooks/method_hook.php
new file mode 100644
index 0000000000..e61a3c7357
--- /dev/null
+++ b/application/hooks/method_hook.php
@@ -0,0 +1,16 @@
+<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
+
+function validate_method()
+{
+
+    $url = $_SERVER['REQUEST_URI'];
+
+    $post_required = preg_match('/(save|delete|delete_item)\/?\d*?/', $url);
+
+    if($post_required && $_SERVER["REQUEST_METHOD"] != "POST" && empty($_POST))
+    {
+        echo "Method not allowed";
+        die;
+    }
+
+}
\ No newline at end of file
diff --git a/application/hooks/save_hook.php b/application/hooks/save_hook.php
deleted file mode 100644
index ccce4c136d..0000000000
--- a/application/hooks/save_hook.php
+++ /dev/null
@@ -1,16 +0,0 @@
-<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
-
-function validate_save()
-{
-
-    $url = $_SERVER['REQUEST_URI'];
-
-    $is_save = preg_match('/save\/\d*?/', $url);
-
-    if($is_save && $_SERVER["REQUEST_METHOD"] != "POST" && empty($_POST))
-    {
-        echo "Method not allowed";
-        die;
-    }
-
-}
\ No newline at end of file