using delete action so security token is not skipped

diff --git a/pages/viewalbum.php b/pages/viewalbum.php
index 3cc854c94c097ab62814be810106e90d5542013e..402c2d7e6a55780c32e80c6f507d945b9a4e8050 100644 (file)
--- a/pages/viewalbum.php
+++ b/pages/viewalbum.php
@@ -52,8 +52,10 @@
                add_submenu_item(       elgg_echo('album:edit'),\r
                                                        $CONFIG->wwwroot . 'pg/photos/edit/' . $album_guid,\r
                                                        'photos');\r
+               $ts = time();\r
+               $token = generate_action_token($ts);\r
                add_submenu_item(       elgg_echo('album:delete'),\r
-                                                       $CONFIG->wwwroot . 'pg/photos/delete/' . $album_guid,\r
+                                                       $CONFIG->wwwroot . 'action/tidypics/delete?guid=' . $album_guid . '&__elgg_token=' . $token . '&__elgg_ts=' . $ts,\r
                                                        'photos',\r
                                                        true);\r
        }\r

diff --git a/pages/viewimage.php b/pages/viewimage.php
index 5caccdf060474697e36314d7b6769e9d0c2abbf1..5f23fc685415ebc09f39daa4d9615ab30cd69987 100644 (file)
--- a/pages/viewimage.php
+++ b/pages/viewimage.php
@@ -39,8 +39,10 @@
                add_submenu_item(       elgg_echo('image:edit'),\r
                                                        $CONFIG->wwwroot . 'pg/photos/edit/' . $photo_guid,\r
                                                        'photos');\r
+               $ts = time();\r
+               $token = generate_action_token($ts);\r
                add_submenu_item(       elgg_echo('image:delete'),\r
-                                                       $CONFIG->wwwroot . 'pg/photos/delete/' . $photo_guid,\r
+                                                       $CONFIG->wwwroot . 'action/tidypics/delete?guid=' . $photo_guid . '&__elgg_token=' . $token . '&__elgg_ts=' . $ts,\r
                                                        'photos',\r
                                                        true);\r
        }\r

diff --git a/start.php b/start.php
index c777331c69266cb9d27283d9a18b78d63c007d62..f0c35c62f85b0ac10c889662eafb0d19b7579af9 100644 (file)
--- a/start.php
+++ b/start.php
@@ -261,11 +261,6 @@
                                        include($CONFIG->pluginspath . "tidypics/pages/edit.php");\r
                                break;\r
 \r
-                               case "delete": //edit image or album\r
-                                       if (isset($page[1])) set_input('guid',$page[1]);\r
-                                       include($CONFIG->pluginspath . "tidypics/actions/delete.php");\r
-                               break;\r
-\r
                                case "friends": // albums of friends\r
                                        if (isset($page[1])) set_input('username',$page[1]);\r
                                        include($CONFIG->pluginspath . "tidypics/pages/friends.php");\r