use csrf protection correctly, fixes #4545

Closes #4545

Merge request studip/studip!3341

1 files changed, 7 insertions, 2 deletions

diff --git a/app/controllers/course/wiki.php b/app/controllers/course/wiki.php
index cf87b08..647ab8a 100644
--- a/app/controllers/course/wiki.php
+++ b/app/controllers/course/wiki.php
@@ -299,9 +299,12 @@ class Course_WikiController extends AuthenticatedController
 
     public function delete_action(WikiPage $page)
     {
-        if (!Request::isPost() || !$page->isEditable() || !CSRFProtection::verifyRequest()) {
+        CSRFProtection::verifyUnsafeRequest();
+
+        if (!$page->isEditable()) {
             throw new AccessDeniedException();
         }
+
         $name = $page->name;
         $page->delete();
         PageLayout::postSuccess(sprintf(_('Die Seite %s wurde gelöscht.'), htmlReady($name)));
@@ -310,7 +313,9 @@ class Course_WikiController extends AuthenticatedController
 
     public function deleteversion_action(WikiPage $page)
     {
-        if (!Request::isPost() || !$page->isEditable() || !CSRFProtection::verifyRequest()) {
+        CSRFProtection::verifyUnsafeRequest();
+
+        if (!$page->isEditable()) {
             throw new AccessDeniedException();
         }