XSS vulnerability when remote-subscribing

[quix0rs-gnu-social.git] / actions / pluginenable.php

diff --git a/actions/pluginenable.php b/actions/pluginenable.php
index 0f2b4ba6702201f8c39de493d0ba465529aa7f1c..707cbdecaab45870995a43d0d08c2354e1c9a9b1 100644 (file)
--- a/actions/pluginenable.php
+++ b/actions/pluginenable.php
@@ -76,7 +76,6 @@ class PluginEnableAction extends Action
             // TRANS: Client error displayed when trying to use another method than POST.
             // TRANS: Do not translate POST.
             $this->clientError(_('This action only accepts POST requests.'));
-            return false;
         }
 
         // CSRF protection
@@ -84,9 +83,9 @@ class PluginEnableAction extends Action
         $token = $this->trimmed('token');
 
         if (!$token || $token != common_session_token()) {
+            // TRANS: Client error displayed when the session token does not match or is not given.
             $this->clientError(_('There was a problem with your session token.'.
                                  ' Try again, please.'));
-            return false;
         }
 
         // Only for logged-in users
@@ -94,15 +93,13 @@ class PluginEnableAction extends Action
         $this->user = common_current_user();
 
         if (empty($this->user)) {
-            // TRANS: Client error displayed when trying to enable or disable a plugin while not logged in.
+            // TRANS: Error message displayed when trying to perform an action that requires a logged in user.
             $this->clientError(_('Not logged in.'));
-            return false;
         }
 
         if (!AdminPanelAction::canAdmin('plugins')) {
             // TRANS: Client error displayed when trying to enable or disable a plugin without access rights.
             $this->clientError(_('You cannot administer plugins.'));
-            return false;
         }
 
         $this->plugin = $this->arg('plugin');
@@ -110,7 +107,6 @@ class PluginEnableAction extends Action
         if (!array_key_exists($this->plugin, $defaultPlugins)) {
             // TRANS: Client error displayed when trying to enable or disable a non-existing plugin.
             $this->clientError(_('No such plugin.'));
-            return false;
         }
 
         return true;
@@ -140,7 +136,7 @@ class PluginEnableAction extends Action
             $form = $this->successNextForm();
             $form->show();
             $this->elementEnd('body');
-            $this->elementEnd('html');
+            $this->endHTML();
         } else {
             $url = common_local_url('pluginsadminpanel');
             common_redirect($url, 303);