Call requireCpRequest() for user photo actions (for now at least)

see #3932
craftcms · Mar 4, 2019 · 406ad76 · 406ad76
1 parent a308a9e
commit 406ad76
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/controllers/UsersController.php b/src/controllers/UsersController.php
@@ -1223,8 +1223,10 @@ public function actionSaveUser()
      */
     public function actionUploadUserPhoto()
     {
+        $this->requireCpRequest();
         $this->requireAcceptsJson();
         $this->requireLogin();
+
         $userId = Craft::$app->getRequest()->getRequiredBodyParam('userId');
 
         if ($userId != Craft::$app->getUser()->getIdentity()->id) {
@@ -1273,11 +1275,14 @@ public function actionUploadUserPhoto()
      * Delete all the photos for current user.
      *
      * @return Response
+     * @throws BadRequestHttpException
      */
     public function actionDeleteUserPhoto(): Response
     {
+        $this->requireCpRequest();
         $this->requireAcceptsJson();
         $this->requireLogin();
+
         $userId = Craft::$app->getRequest()->getRequiredBodyParam('userId');
 
         if ($userId != Craft::$app->getUser()->getIdentity()->id) {