Twitter integration - support for new foreign_link table and prefs now save/update

[quix0rs-gnu-social.git] / actions / avatar.php

diff --git a/actions/avatar.php b/actions/avatar.php
index b1697f97bbb734a3e09d1f5d1bd6bc91de95cfd9..9f397e93c3e0148248955ae8746308a489631f02 100644 (file)
--- a/actions/avatar.php
+++ b/actions/avatar.php
@@ -23,10 +23,6 @@ require_once(INSTALLDIR.'/lib/settingsaction.php');
 
 class AvatarAction extends SettingsAction {
 
-       function is_readonly() {
-               return false;
-       }
-
     function get_instructions() {
                return _('Upload a new "avatar" (user image) here. You can\'t edit the picture after you upload it, so make sure it\'s more or less square. It must be under the site license, also. Use a picture that belongs to you and that you want to share.');
        }
@@ -62,6 +58,7 @@ class AvatarAction extends SettingsAction {
                                                                                   'id' => 'avatar',
                                                                                   'action' =>
                                                                                   common_local_url('avatar')));
+               common_hidden('token', common_session_token());
                common_element('input', array('name' => 'MAX_FILE_SIZE',
                                                                          'type' => 'hidden',
                                                                          'id' => 'MAX_FILE_SIZE',
@@ -76,6 +73,14 @@ class AvatarAction extends SettingsAction {
 
        function handle_post() {
 
+               # CSRF protection
+
+               $token = $this->trimmed('token');
+               if (!$token || $token != common_session_token()) {
+                       $this->show_form(_('There was a problem with your session token. Try again, please.'));
+                       return;
+               }
+
                switch ($_FILES['avatarfile']['error']) {
                 case UPLOAD_ERR_OK: # success, jump out
                        break;