| @@ -44,12 +44,29 @@ | ||
| 44 | 44 | { |
| 45 | 45 | $return = ''; |
| 46 | 46 | } |
| 47 | 47 | |
| 48 | + /** | |
| 49 | + * Added token validation. | |
| 50 | + * | |
| 51 | + * @since 1.7.3 | |
| 52 | + */ | |
| 53 | + if (!JSession::checkToken()) | |
| 54 | + { | |
| 55 | + // back to main list, missing CSRF-proof token | |
| 56 | + $app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error'); | |
| 57 | + $this->cancel(); | |
| 58 | + | |
| 59 | + return false; | |
| 60 | + } | |
| 61 | + | |
| 48 | 62 | // make sure the user is authorised to change ACL |
| 49 | 63 | if (!JFactory::getUser()->authorise('core.admin', 'com_vikbooking')) |
| 50 | 64 | { |
| 51 | - $app->redirect($return); | |
| 65 | + $app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error'); | |
| 66 | + $this->cancel(); | |
| 67 | + | |
| 68 | + return false; | |
| 52 | 69 | } |
| 53 | 70 | |
| 54 | 71 | $data = $input->get('acl', array(), 'array'); |
| 55 | 72 | |
| @@ -66,9 +83,9 @@ | ||
| 66 | 83 | { |
| 67 | 84 | $return = 'admin.php?option=com_vikbooking&view=acl&activerole=' . $active . '&return=' . $encoded; |
| 68 | 85 | } |
| 69 | 86 | |
| 70 | - $app->redirect($return); | |
| 87 | + $this->setRedirect($return); | |
| 71 | 88 | } |
| 72 | 89 | |
| 73 | 90 | public function cancel() |
| 74 | 91 | { |
| @@ -80,7 +97,7 @@ | ||
| 80 | 97 | { |
| 81 | 98 | $return = base64_decode($return); |
| 82 | 99 | } |
| 83 | 100 | |
| 84 | - $app->redirect($return); | |
| 101 | + $this->setRedirect($return); | |
| 85 | 102 | } |
| 86 | 103 | } |
