csrf protection in userauthorization

[quix0rs-gnu-social.git] / lib / deleteaction.php

diff --git a/lib/deleteaction.php b/lib/deleteaction.php
index 5d7a3245ae47931ff3e5e05ac784b41cfda130e2..5ba0e7e44283d3705dac1dddae4e73df69a1fcfc 100644 (file)
--- a/lib/deleteaction.php
+++ b/lib/deleteaction.php
@@ -23,39 +23,39 @@ class DeleteAction extends Action {
 
        function handle($args) {
                parent::handle($args);
-                $user = common_current_user();
-                $notice_id = $this->trimmed('notice');
-                $notice = Notice::staticGet($notice_id);
-                $profile = $notice->getProfile();
-                $user_profile = $user->getProfile();
-
-                if (!common_logged_in()) {
-                    common_user_error(_('Not logged in.'));
-                } else if ($notice->profile_id != $user_profile->id) {
-                    common_user_error(_('Can\'t delete this notice.'));
-                }
+               $user = common_current_user();
+               $notice_id = $this->trimmed('notice');
+               $notice = Notice::staticGet($notice_id);
+               if (!$notice) {
+                       common_user_error(_('No such notice.'));
+                       exit;
+               }
+
+               $profile = $notice->getProfile();
+               $user_profile = $user->getProfile();
+
+               if (!common_logged_in()) {
+                       common_user_error(_('Not logged in.'));
+                       exit;
+               } else if ($notice->profile_id != $user_profile->id) {
+                       common_user_error(_('Can\'t delete this notice.'));
+                       exit;
+               }
        }
 
        function show_top($arr=NULL) {
-               if ($arr) {
-                       $error = $arr[1];
-               }
-               if ($error) {
-                       common_element('p', 'error', $error);
-               } else {
-                       $instr = $this->get_instructions();
-                       $output = common_markup_to_html($instr);
-                       common_element_start('div', 'instructions');
-                       common_raw($output);
-                       common_element_end('div');
-               }
+               $instr = $this->get_instructions();
+               $output = common_markup_to_html($instr);
+               common_element_start('div', 'instructions');
+               common_raw($output);
+               common_element_end('div');
        }
 
        function get_title() {
                return NULL;
        }
 
-       function show_header($arr) {
+       function show_header() {
                return;
        }
 }