Normalize CSRF handling into the access helper. Probably not the best

place for it, but it'll do for now.

Do CSRF checking in the Admin controller so that we're safe across the
board on the admin side.

1 files changed, 4 insertions, 0 deletions

diff --git a/core/controllers/admin.php b/core/controllers/admin.php
index 2a6bae7e..6e44c54e 100644
--- a/core/controllers/admin.php
+++ b/core/controllers/admin.php
@@ -33,6 +33,10 @@ class Admin_Controller extends Controller {
   }
 
   public function __call($controller_name, $args) {
+    if (request::method() == "post") {
+      access::verify_csrf();
+    }
+
     if ($controller_name == "index") {
       $controller_name = "dashboard";
     }