#9409 Add CSRF check to review read operation

pkp · Oct 12, 2023 · 04e0e0e · 04e0e0e
1 parent 2e176bc
commit 04e0e0e
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/classes/controllers/grid/users/reviewer/PKPReviewerGridHandler.inc.php b/classes/controllers/grid/users/reviewer/PKPReviewerGridHandler.inc.php
@@ -550,6 +550,8 @@ function unconsiderReview($args, $request) {
 	 * @return JSONMessage JSON object
 	 */
 	function reviewRead($args, $request) {
+		if (!$request->checkCSRF()) return new JSONMessage(false);
+
 		// Retrieve review assignment.
 		$reviewAssignment = $this->getAuthorizedContextObject(ASSOC_TYPE_REVIEW_ASSIGNMENT); /* @var $reviewAssignment ReviewAssignment */