Changeset 25382 for trunk

Timestamp:

Nov 7, 2013, 10:02:52 PM (11 years ago)

Author:

rvelices

Message:

post_only for ws admin write methods without token (avoid XSRF)

File:

• trunk/ws.php (modified) (2 diffs)

trunk/ws.php

@@ -788 +788 @@
       '<b>Admin only.</b> Adds one or more users to a group.',
       $ws_functions_root . 'pwg.groups.php',
-      array('admin_only'=>true)
+      array('admin_only'=>true, 'post_only'=>true)
     );
 
@@ -931 +931 @@
       '<b>Admin only.</b> Adds permissions to an album.',
       $ws_functions_root . 'pwg.permissions.php',
-      array('admin_only'=>true)
+      array('admin_only'=>true, 'post_only'=>true)
     );