From f7b6e27ea2558ddfc97547178408841c5d51c5b6 Mon Sep 17 00:00:00 2001
From: Michael Hamann <michael@content-space.de>
Date: Wed, 25 May 2011 12:15:04 +0200
Subject: Remove the security token from the ajax draft/lock calls again

The security token here doesn't improve the security as the other
requests that allow you to do the same thing aren't protected and I
don't see why locking or draft creation should be subject of XSRF
attacks.
---
 lib/exe/ajax.php | 2 --
 1 file changed, 2 deletions(-)

(limited to 'lib/exe')

diff --git a/lib/exe/ajax.php b/lib/exe/ajax.php
index b2463ed3f..1056a05f8 100644
--- a/lib/exe/ajax.php
+++ b/lib/exe/ajax.php
@@ -128,7 +128,6 @@ function ajax_lock(){
 
     $ID = cleanID($_POST['id']);
     if(empty($ID)) return;
-    if (!checkSecurityToken()) return;
 
     $INFO = pageinfo();
 
@@ -169,7 +168,6 @@ function ajax_lock(){
 function ajax_draftdel(){
     $id = cleanID($_REQUEST['id']);
     if(empty($id)) return;
-    if (!checkSecurityToken()) return;
 
     $client = $_SERVER['REMOTE_USER'];
     if(!$client) $client = clientIP(true);
-- 
cgit v1.2.3