2 files changed, 2 insertions, 1 deletions
diff --git a/modules/gallery/controllers/permissions.php b/modules/gallery/controllers/permissions.php
index 5f4620b2..8d75862e 100644
--- a/modules/gallery/controllers/permissions.php
+++ b/modules/gallery/controllers/permissions.php
@@ -81,7 +81,7 @@ class Permissions_Controller extends Controller {
     }
   }
 
-  function _get_form($item) {
+  private function _get_form($item) {
     $view = new View("permissions_form.html");
     $view->item = $item;
     $view->groups = ORM::factory("group")->find_all();
diff --git a/modules/gallery/controllers/simple_uploader.php b/modules/gallery/controllers/simple_uploader.php
index 156d18ac..bc508319 100644
--- a/modules/gallery/controllers/simple_uploader.php
+++ b/modules/gallery/controllers/simple_uploader.php
@@ -32,6 +32,7 @@ class Simple_Uploader_Controller extends Controller {
   }
 
   public function start() {
+    access::verify_csrf();
     batch::start();
   }