Changeset 1613

Show
Ignore:
Timestamp:
08/06/08 07:46:14 (4 months ago)
Author:
misja
Message:

Applied attachment:ticket:383:commentwall.diff, fixes #383

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • devel/mod/commentwall/do_action.php

    r1550 r1613  
    2626        if ($action == "commentwall::post") 
    2727        { 
    28                         
    29                 // Store the rating 
    30         $success = (empty($text)) ? false : commentwall_addcomment($wallowner, $comment_owner, $text); 
     28                // Store the comment if successful 
     29    // Check the form key here 
     30    $success = ((empty($text)) || !elggform_key_check(optional_param('form_key'), "commentwall_{$wallowner}_post")) ? false : commentwall_addcomment($wallowner, $comment_owner, $text); 
    3131 
    3232                // Message 

  • devel/mod/commentwall/lib.php

    r1607 r1613  
    202202                if ($returnurl=="") 
    203203                        $returnurl = urlencode($_SERVER['REQUEST_URI']); 
     204    $form_key = elggform_key_get("commentwall_{$wall_owner}_post"); 
    204205                $buttontxt = __gettext("Post comment"); 
    205206                 
    …… 
    211212                        <input type="hidden" name="comment_owner" value="{$_SESSION['userid']}" />               
    212213                        <input type="hidden" name="return_url" value="$returnurl" /> 
     214      <input type="hidden" name="form_key" value="$form_key" /> 
    213215                        <textarea name="text"></textarea> 
    214216END;