diff --git a/airtime_mvc/application/controllers/plugins/Acl_plugin.php b/airtime_mvc/application/controllers/plugins/Acl_plugin.php index 06f84b834..923b2cf05 100644 --- a/airtime_mvc/application/controllers/plugins/Acl_plugin.php +++ b/airtime_mvc/application/controllers/plugins/Acl_plugin.php @@ -169,6 +169,12 @@ class Zend_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract // we need to check the CSRF token if ($_SERVER['REQUEST_METHOD'] != "GET" && $request->getModuleName() == "rest") { $token = $request->getParam("csrf_token"); + // PUT requests don't parameterize the data in the body, so we can't + // fetch it with getParam or getPost; instead we have to parse the body and + // check for the token in the JSON. (Hopefully we can find a better way to do this) -- Duncan + if (empty($token)) { + $token = json_decode($this->getRequest()->getRawBody(), true)["csrf_token"]; + } $tokenValid = $this->verifyCSRFToken($token); if (!$tokenValid) { diff --git a/airtime_mvc/application/views/scripts/podcast/podcast.phtml b/airtime_mvc/application/views/scripts/podcast/podcast.phtml index eb95e5987..70dddfc12 100644 --- a/airtime_mvc/application/views/scripts/podcast/podcast.phtml +++ b/airtime_mvc/application/views/scripts/podcast/podcast.phtml @@ -1,4 +1,4 @@ -