aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarc Alexander <admin@m-a-styles.de>2020-01-07 20:26:56 +0100
committerMarc Alexander <admin@m-a-styles.de>2020-01-07 20:26:56 +0100
commit11d7b71959e844d427d77c8fec46b22082675948 (patch)
tree393bd781cde56ad81c13a56ec8aa1bde07754cac /phpBB/includes/functions_privmsgs.php
parentMerge branch 'prep-release-3.2.9' into 3.2.x (diff)
downloadphpbb-11d7b71959e844d427d77c8fec46b22082675948.tar.gz
phpbb-11d7b71959e844d427d77c8fec46b22082675948.tar.bz2
phpbb-11d7b71959e844d427d77c8fec46b22082675948.zip
[ticket/16296] Adjust form token check for mark actions
PHPBB3-16296
Diffstat (limited to 'phpBB/includes/functions_privmsgs.php')
-rw-r--r--phpBB/includes/functions_privmsgs.php5
1 files changed, 5 insertions, 0 deletions
diff --git a/phpBB/includes/functions_privmsgs.php b/phpBB/includes/functions_privmsgs.php
index f07512d623..436b437cfa 100644
--- a/phpBB/includes/functions_privmsgs.php
+++ b/phpBB/includes/functions_privmsgs.php
@@ -958,6 +958,11 @@ function handle_mark_actions($user_id, $mark_action)
{
case 'mark_important':
+ if (!check_form_key('ucp_pm_view'))
+ {
+ trigger_error('FORM_INVALID');
+ }
+
$sql = 'UPDATE ' . PRIVMSGS_TO_TABLE . "
SET pm_marked = 1 - pm_marked
WHERE folder_id = $cur_folder_id