Merge pull request #10717 from nupplaphil/bug/drone_missing_bin

[friendica.git] / src / Module / Contact.php

diff --git a/src/Module/Contact.php b/src/Module/Contact.php
index 6f32356a3260b81c408bdde0255e01c4b4ce76ed..ceb2b6757c3fd2329a28ec898af6e98b462b4762 100644 (file)
--- a/src/Module/Contact.php
+++ b/src/Module/Contact.php
@@ -59,6 +59,10 @@ class Contact extends BaseModule
                        return;
                }
 
+               $redirectUrl = $_POST['redirect_url'] ?? 'contact';
+
+               self::checkFormSecurityTokenRedirectOnError($redirectUrl, 'contact_batch_actions');
+
                $orig_records = Model\Contact::selectToArray(['id', 'uid'], ['id' => $_POST['contact_batch'], 'uid' => [0, local_user()], 'self' => false, 'deleted' => false]);
 
                $count_actions = 0;
@@ -93,7 +97,7 @@ class Contact extends BaseModule
                        info(DI::l10n()->tt('%d contact edited.', '%d contacts edited.', $count_actions));
                }
 
-               DI::baseUrl()->redirect($_POST['redirect_url'] ?? 'contact');
+               DI::baseUrl()->redirect($redirectUrl);
        }
 
        public static function post(array $parameters = [])
@@ -361,6 +365,16 @@ class Contact extends BaseModule
                                throw new NotFoundException(DI::l10n()->t('Contact not found'));
                        }
 
+                       if ($cmd === 'posts') {
+                               return self::getPostsHTML($a, $contact_id);
+                       }
+
+                       if ($cmd === 'conversations') {
+                               return self::getConversationsHMTL($a, $contact_id, $update);
+                       }
+
+                       self::checkFormSecurityTokenRedirectOnError('contact/' . $contact_id, 'contact_action', 't');
+
                        $cdata = Model\Contact::getPublicAndUserContactID($orig_record['id'], local_user());
                        if (empty($cdata)) {
                                throw new NotFoundException(DI::l10n()->t('Contact not found'));
@@ -418,7 +432,8 @@ class Contact extends BaseModule
                                                '$message' => DI::l10n()->t('Do you really want to delete this contact?'),
                                                '$confirm' => DI::l10n()->t('Yes'),
                                                '$confirm_url' => DI::args()->getCommand(),
-                                               '$confirm_name' => 'confirmed',
+                                               '$confirm_name' => 't',
+                                               '$confirm_value' => BaseModule::getFormSecurityToken('contact_action'),
                                                '$cancel' => DI::l10n()->t('Cancel'),
                                        ]);
                                }
@@ -434,12 +449,6 @@ class Contact extends BaseModule
                                DI::baseUrl()->redirect('contact');
                                // NOTREACHED
                        }
-                       if ($cmd === 'posts') {
-                               return self::getPostsHTML($a, $contact_id);
-                       }
-                       if ($cmd === 'conversations') {
-                               return self::getConversationsHMTL($a, $contact_id, $update);
-                       }
                }
 
                $_SESSION['return_path'] = DI::args()->getQueryString();
@@ -840,6 +849,7 @@ class Contact extends BaseModule
                        '$submit'     => DI::l10n()->t('Find'),
                        '$cmd'        => DI::args()->getCommand(),
                        '$contacts'   => $contacts,
+                       '$form_security_token'  => BaseModule::getFormSecurityToken('contact_batch_actions'),
                        '$contact_drop_confirm' => DI::l10n()->t('Do you really want to delete this contact?'),
                        'multiselect' => 1,
                        '$batch_actions' => [
@@ -1080,6 +1090,8 @@ class Contact extends BaseModule
                $poll_enabled = in_array($contact['network'], [Protocol::ACTIVITYPUB, Protocol::DFRN, Protocol::OSTATUS, Protocol::FEED, Protocol::MAIL]);
                $contact_actions = [];
 
+               $formSecurityToken = self::getFormSecurityToken('contact_action');
+
                // Provide friend suggestion only for Friendica contacts
                if ($contact['network'] === Protocol::DFRN) {
                        $contact_actions['suggest'] = [
@@ -1094,7 +1106,7 @@ class Contact extends BaseModule
                if ($poll_enabled) {
                        $contact_actions['update'] = [
                                'label' => DI::l10n()->t('Update now'),
-                               'url'   => 'contact/' . $contact['id'] . '/update',
+                               'url'   => 'contact/' . $contact['id'] . '/update?t=' . $formSecurityToken,
                                'title' => '',
                                'sel'   => '',
                                'id'    => 'update',
@@ -1104,7 +1116,7 @@ class Contact extends BaseModule
                if (in_array($contact['network'], Protocol::NATIVE_SUPPORT)) {
                        $contact_actions['updateprofile'] = [
                                'label' => DI::l10n()->t('Refetch contact data'),
-                               'url'   => 'contact/' . $contact['id'] . '/updateprofile',
+                               'url'   => 'contact/' . $contact['id'] . '/updateprofile?t=' . $formSecurityToken,
                                'title' => '',
                                'sel'   => '',
                                'id'    => 'updateprofile',
@@ -1113,7 +1125,7 @@ class Contact extends BaseModule
 
                $contact_actions['block'] = [
                        'label' => (intval($contact['blocked']) ? DI::l10n()->t('Unblock') : DI::l10n()->t('Block')),
-                       'url'   => 'contact/' . $contact['id'] . '/block',
+                       'url'   => 'contact/' . $contact['id'] . '/block?t=' . $formSecurityToken,
                        'title' => DI::l10n()->t('Toggle Blocked status'),
                        'sel'   => (intval($contact['blocked']) ? 'active' : ''),
                        'id'    => 'toggle-block',
@@ -1121,7 +1133,7 @@ class Contact extends BaseModule
 
                $contact_actions['ignore'] = [
                        'label' => (intval($contact['readonly']) ? DI::l10n()->t('Unignore') : DI::l10n()->t('Ignore')),
-                       'url'   => 'contact/' . $contact['id'] . '/ignore',
+                       'url'   => 'contact/' . $contact['id'] . '/ignore?t=' . $formSecurityToken,
                        'title' => DI::l10n()->t('Toggle Ignored status'),
                        'sel'   => (intval($contact['readonly']) ? 'active' : ''),
                        'id'    => 'toggle-ignore',
@@ -1130,7 +1142,7 @@ class Contact extends BaseModule
                if ($contact['uid'] != 0) {
                        $contact_actions['delete'] = [
                                'label' => DI::l10n()->t('Delete'),
-                               'url'   => 'contact/' . $contact['id'] . '/drop',
+                               'url'   => 'contact/' . $contact['id'] . '/drop?t=' . $formSecurityToken,
                                'title' => DI::l10n()->t('Delete contact'),
                                'sel'   => '',
                                'id'    => 'delete',