Always generating action tokens with output/confirmlink.

Includes a check for actions already defining the tokens.

git-svn-id: http://code.elgg.org/elgg/trunk@3799 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/engine/lib/elgglib.php b/engine/lib/elgglib.php
index d5d0828b68b0a516ddd96ed062eda79df7cb5b16..c0d19743a6222e64605da516a8664ca10dae938a 100644 (file)
--- a/engine/lib/elgglib.php
+++ b/engine/lib/elgglib.php
@@ -2413,6 +2413,40 @@ interface Friendable {
        public function countObjects($subtype = "");
 }
 
+/**
+ * Rebuilds the parsed URL
+ *
+ * @param array $parts Associative array of URL components like parse_url() returns
+ * @return str Full URL
+ * @since 1.7
+ */
+function elgg_http_build_url(array $parts) {
+       return "{$parts['scheme']}://{$parts['host']}{$parts['path']}?{$parts['query']}";
+}
+
+/**
+ * Ensures action tokens are present in the given link
+ *
+ * @param str $link Full action URL
+ * @return str Validated URL
+ * @since 1.7
+ */
+function elgg_validate_action_url($link) {
+       $url = parse_url($link);
+       parse_str($url['query'], $query);
+       if (array_key_exists('__elgg_token', $query)) {
+               return $link;
+       }
+
+       // apend action tokens to the existing query
+       $query['__elgg_ts'] = time();
+       $query['__elgg_token'] = generate_action_token($query['__elgg_ts']);
+       $url['query'] = http_build_query($query);
+
+       // rebuild the full url
+       return elgg_http_build_url($url);
+}
+
 
 /**
  * Server javascript pages.

diff --git a/views/default/output/confirmlink.php b/views/default/output/confirmlink.php
index e95dd5f31e66f872fd7efdef5c157967e4890cad..9377426ad62b517e05d8f807d5b89124088570bd 100644 (file)
--- a/views/default/output/confirmlink.php
+++ b/views/default/output/confirmlink.php
@@ -19,16 +19,8 @@ if (!$confirm) {
        $confirm = elgg_echo('question:areyousure');
 }
 
-$link = $vars['href'];
-
-if (isset($vars['is_action']) && $vars['is_action']) {
-       $ts = time();
-       $token = generate_action_token($ts);
-
-       $sep = "?";
-       if (strpos($link, '?')>0) $sep = "&";
-       $link = "$link{$sep}__elgg_token=$token&__elgg_ts=$ts";
-}
+// always generate missing action tokens
+$link = elgg_validate_action_url($vars['href']);
 
 if (isset($vars['class']) && $vars['class']) {
        $class = 'class="' . $vars['class'] . '"';