strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Move unsecured GET endpoint handlers before security token check in Module\Contact

Browse source
This commit is contained in:
Hypolite Petovan 2021-09-10 12:05:43 -04:00
parent 75d3f5094b
commit 8b450be09b
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/Module/Contact.php
View file

@ -365,6 +365,14 @@ class Contact extends BaseModule
throw new NotFoundException(DI::l10n()->t('Contact not found'));
}
if ($cmd === 'posts') {
return self::getPostsHTML($a, $contact_id);
}
if ($cmd === 'conversations') {
return self::getConversationsHMTL($a, $contact_id, $update);
}
self::checkFormSecurityTokenRedirectOnError('contact/' . $contact_id, 'contact_action', 't');
$cdata = Model\Contact::getPublicAndUserContactID($orig_record['id'], local_user());
@ -440,12 +448,6 @@ class Contact extends BaseModule
DI::baseUrl()->redirect('contact');
// NOTREACHED
}
if ($cmd === 'posts') {
return self::getPostsHTML($a, $contact_id);
}
if ($cmd === 'conversations') {
return self::getConversationsHMTL($a, $contact_id, $update);
}
}
$_SESSION['return_path'] = DI::args()->getQueryString();