CVE-2012-4393: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: apps/bookmarks/ajax/addBookmark.php, apps/bookmarks/ajax/delBookmark.php, apps/bookmarks/ajax/editBookmark.php, apps/calendar/ajax/calendar/delete.php, apps/calendar/ajax/calendar/edit.php, apps/calendar/ajax/calendar/new.php, apps/calendar/ajax/calendar/update.php, apps/calendar/ajax/event/delete.php, apps/calendar/ajax/event/edit.php, apps/calendar/ajax/event/move.php, apps/calendar/ajax/event/new.php, apps/calendar/ajax/import/import.php, apps/calendar/ajax/settings/setfirstday.php, apps/calendar/ajax/settings/settimeformat.php, apps/calendar/ajax/share/changepermission.php, apps/calendar/ajax/share/share.php, apps/calendar/ajax/share/unshare.php, apps/external/ajax/setsites.php, apps/files/ajax/delete.php, apps/files/ajax/move.php, apps/files/ajax/newfile.php, apps/files/ajax/newfolder.php, apps/files/ajax/rename.php, apps/files_sharing/ajax/email.php, apps/files_sharing/ajax/setpermissions.php, apps/files_sharing/ajax/share.php, apps/files_sharing/ajax/toggleresharing.php, apps/files_sharing/ajax/togglesharewitheveryone.php, apps/files_sharing/ajax/unshare.php, apps/files_texteditor/ajax/savefile.php, apps/files_versions/ajax/rollbackVersion.php, apps/gallery/ajax/createAlbum.php, apps/gallery/ajax/sharing.php, apps/tasks/ajax/addtask.php, apps/tasks/ajax/addtaskform.php, apps/tasks/ajax/delete.php, apps/tasks/ajax/edittask.php
Commit date: 2012-07-20 20:12:36 +0200
Commit message: Added CSRF checks

Diff: diff --git a/apps/bookmarks/ajax/addBookmark.php b/apps/bookmarks/ajax/addBookmark.php
index a2eb506f..b4d0f33d 100644
--- a/apps/bookmarks/ajax/addBookmark.php
+++ b/apps/bookmarks/ajax/addBookmark.php
@@ -27,9 +27,10 @@ $RUNTIME_NOSETUPFS=true;
  
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('bookmarks');
+OCP\JSON::callCheck();
 
 require_once(OC::$APPSROOT . '/apps/bookmarks/bookmarksHelper.php');
 $id = addBookmark($_POST['url'], $_POST['title'], $_POST['tags']);
 OCP\JSON::success(array('data' => $id));
\ No newline at end of file
diff --git a/apps/bookmarks/ajax/delBookmark.php b/apps/bookmarks/ajax/delBookmark.php
index 5a067701..140da2a3 100644
--- a/apps/bookmarks/ajax/delBookmark.php
+++ b/apps/bookmarks/ajax/delBookmark.php
@@ -27,10 +27,11 @@ $RUNTIME_NOSETUPFS=true;
  
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('bookmarks');
+OCP\JSON::callCheck();
 
 $id = $_POST['id'];
 if (!OC_Bookmarks_Bookmarks::deleteUrl($id)){
 	OC_JSON::error();
 	exit();
diff --git a/apps/bookmarks/ajax/editBookmark.php b/apps/bookmarks/ajax/editBookmark.php
index 439b680d..36258f70 100644
--- a/apps/bookmarks/ajax/editBookmark.php
+++ b/apps/bookmarks/ajax/editBookmark.php
@@ -27,10 +27,11 @@ $RUNTIME_NOSETUPFS=true;
  
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('bookmarks');
+OCP\JSON::callCheck();
 
 $CONFIG_DBTYPE = OCP\Config::getSystemValue( "dbtype", "sqlite" );
 if( $CONFIG_DBTYPE == 'sqlite' or $CONFIG_DBTYPE == 'sqlite3' ){
 	$_ut = "strftime('%s','now')";
 } elseif($CONFIG_DBTYPE == 'pgsql') {
diff --git a/apps/calendar/ajax/calendar/delete.php b/apps/calendar/ajax/calendar/delete.php
index 4d6706f6..089255ca 100644
--- a/apps/calendar/ajax/calendar/delete.php
+++ b/apps/calendar/ajax/calendar/delete.php
@@ -7,10 +7,11 @@
  */
  
 
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 $cal = $_POST["calendarid"];
 $calendar = OC_Calendar_App::getCalendar($cal, true);
 if(!$calendar){
 	OCP\JSON::error(array('message'=>'permission denied'));
diff --git a/apps/calendar/ajax/calendar/edit.php b/apps/calendar/ajax/calendar/edit.php
index 82f18fe7..3f69666b 100644
--- a/apps/calendar/ajax/calendar/edit.php
+++ b/apps/calendar/ajax/calendar/edit.php
@@ -7,10 +7,11 @@
  */
 
  
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 $calendarcolor_options = OC_Calendar_Calendar::getCalendarColorOptions();
 $calendar = OC_Calendar_App::getCalendar($_GET['calendarid'], true);
 if(!$calendar){
 	OCP\JSON::error(array('message'=>'permission denied'));
diff --git a/apps/calendar/ajax/calendar/new.php b/apps/calendar/ajax/calendar/new.php
index 278c8e55..34b056ab 100644
--- a/apps/calendar/ajax/calendar/new.php
+++ b/apps/calendar/ajax/calendar/new.php
@@ -9,10 +9,11 @@
  
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 if(trim($_POST['name']) == ''){
 	OCP\JSON::error(array('message'=>'empty'));
 	exit;
 }
diff --git a/apps/calendar/ajax/calendar/update.php b/apps/calendar/ajax/calendar/update.php
index 5cf63d39..74009477 100644
--- a/apps/calendar/ajax/calendar/update.php
+++ b/apps/calendar/ajax/calendar/update.php
@@ -9,10 +9,11 @@
  
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 if(trim($_POST['name']) == ''){
 	OCP\JSON::error(array('message'=>'empty'));
 	exit;
 }
diff --git a/apps/calendar/ajax/event/delete.php b/apps/calendar/ajax/event/delete.php
index f183d431..17e45c00 100644
--- a/apps/calendar/ajax/event/delete.php
+++ b/apps/calendar/ajax/event/delete.php
@@ -7,10 +7,11 @@
  */
  
 
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 $id = $_POST['id'];
 $access = OC_Calendar_App::getaccess($id, OC_Calendar_App::EVENT);
 if($access != 'owner' && $access != 'rw'){
 	OCP\JSON::error(array('message'=>'permission denied'));
diff --git a/apps/calendar/ajax/event/edit.php b/apps/calendar/ajax/event/edit.php
index 1c3babc3..db78bf6e 100644
--- a/apps/calendar/ajax/event/edit.php
+++ b/apps/calendar/ajax/event/edit.php
@@ -7,10 +7,11 @@
  */
 
  
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 $id = $_POST['id'];
 
 if(!array_key_exists('calendar', $_POST)){
 	$cal = OC_Calendar_Object::getCalendarid($id);
diff --git a/apps/calendar/ajax/event/move.php b/apps/calendar/ajax/event/move.php
index 04cf2fb0..f4e2b363 100644
--- a/apps/calendar/ajax/event/move.php
+++ b/apps/calendar/ajax/event/move.php
@@ -5,10 +5,11 @@
  * later.
  * See the COPYING-README file.
  */
  
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 $id = $_POST['id'];
 $access = OC_Calendar_App::getaccess($id, OC_Calendar_App::EVENT);
 if($access != 'owner' && $access != 'rw'){
 	OCP\JSON::error(array('message'=>'permission denied'));
diff --git a/apps/calendar/ajax/event/new.php b/apps/calendar/ajax/event/new.php
index 30e2b0ca..bc0439cc 100644
--- a/apps/calendar/ajax/event/new.php
+++ b/apps/calendar/ajax/event/new.php
@@ -8,10 +8,11 @@
 
  
 
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('calendar');
+OCP\JSON::callCheck();
 
 $errarr = OC_Calendar_Object::validateRequest($_POST);
 if($errarr){
 	//show validate errors
 	OCP\JSON::error($errarr);
diff --git a/apps/calendar/ajax/import/import.php b/apps/calendar/ajax/import/import.php
index 18e93e67..c0cd1403 100644
--- a/apps/calendar/ajax/import/import.php
+++ b/apps/calendar/ajax/import/import.php
@@ -6,10 +6,11 @@
  * See the COPYING-README file.
  */
 //check for calendar rights or create new one
 ob_start();
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 OCP\App::checkAppEnabled('calendar');
 $nl="\r\n";
 $comps = array('VEVENT'=>true, 'VTODO'=>true, 'VJOURNAL'=>true);
 $progressfile = 'import_tmp/' . md5(session_id()) . '.txt';
 if(is_writable('import_tmp/')){
diff --git a/apps/calendar/ajax/settings/setfirstday.php b/apps/calendar/ajax/settings/setfirstday.php
index 056a6037..97c24882 100644
--- a/apps/calendar/ajax/settings/setfirstday.php
+++ b/apps/calendar/ajax/settings/setfirstday.php
@@ -5,10 +5,12 @@
  * later.
  * See the COPYING-README file.
  */
  
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
+
 if(isset($_POST["firstday"])){
 	OCP\Config::setUserValue(OCP\USER::getUser(), 'calendar', 'firstday', $_POST["firstday"]);
 	OCP\JSON::success();
 }else{
 	OCP\JSON::error();
diff --git a/apps/calendar/ajax/settings/settimeformat.php b/apps/calendar/ajax/settings/settimeformat.php
index 8e95f6f3..d09679b9 100644
--- a/apps/calendar/ajax/settings/settimeformat.php
+++ b/apps/calendar/ajax/settings/settimeformat.php
@@ -5,10 +5,12 @@
  * later.
  * See the COPYING-README file.
  */
  
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
+
 if(isset($_POST["timeformat"])){
 	OCP\Config::setUserValue(OCP\USER::getUser(), 'calendar', 'timeformat', $_POST["timeformat"]);
 	OCP\JSON::success();
 }else{
 	OCP\JSON::error();
diff --git a/apps/calendar/ajax/share/changepermission.php b/apps/calendar/ajax/share/changepermission.php
index 2737420c..f3c628e8 100644
--- a/apps/calendar/ajax/share/changepermission.php
+++ b/apps/calendar/ajax/share/changepermission.php
@@ -3,11 +3,12 @@
  * Copyright (c) 2012 Georg Ehrke <ownclouddev@georgswebsite.de>
  * This file is licensed under the Affero General Public License version 3 or
  * later.
  * See the COPYING-README file.
  */
- 
+ OCP\JSON::callCheck();
+
 $id = strip_tags($_GET['id']);
 $idtype = strip_tags($_GET['idtype']);
 $permission = (int) strip_tags($_GET['permission']);
 switch($idtype){
 	case 'calendar':
diff --git a/apps/calendar/ajax/share/share.php b/apps/calendar/ajax/share/share.php
index 629a7b6b..babb8ce3 100644
--- a/apps/calendar/ajax/share/share.php
+++ b/apps/calendar/ajax/share/share.php
@@ -3,11 +3,12 @@
  * Copyright (c) 2012 Georg Ehrke <ownclouddev@georgswebsite.de>
  * This file is licensed under the Affero General Public License version 3 or
  * later.
  * See the COPYING-README file.
  */
- 
+ OCP\JSON::callCheck();
+
 $id = strip_tags($_GET['id']);
 $idtype = strip_tags($_GET['idtype']);
 switch($idtype){
 	case 'calendar':
 	case 'event':
diff --git a/apps/calendar/ajax/share/unshare.php b/apps/calendar/ajax/share/unshare.php
index fe7c9845..09264070 100644
--- a/apps/calendar/ajax/share/unshare.php
+++ b/apps/calendar/ajax/share/unshare.php
@@ -3,11 +3,12 @@
  * Copyright (c) 2012 Georg Ehrke <ownclouddev@georgswebsite.de>
  * This file is licensed under the Affero General Public License version 3 or
  * later.
  * See the COPYING-README file.
  */
- 
+ OCP\JSON::callCheck();
+
 $id = strip_tags($_GET['id']);
 $idtype = strip_tags($_GET['idtype']);
 switch($idtype){
 	case 'calendar':
 	case 'event':
diff --git a/apps/external/ajax/setsites.php b/apps/external/ajax/setsites.php
index f153735f..0dbac3ab 100644
--- a/apps/external/ajax/setsites.php
+++ b/apps/external/ajax/setsites.php
@@ -6,10 +6,11 @@
  * See the COPYING-README file.
  */
 
  
 OCP\User::checkAdminUser();
+OCP\JSON::callCheck();
 
 $sites = array();
 for ($i = 0; $i < sizeof($_POST['site_name']); $i++) {
 	if (!empty($_POST['site_name'][$i]) && !empty($_POST['site_url'][$i])) {
 		array_push($sites, array(strip_tags($_POST['site_name'][$i]), strip_tags($_POST['site_url'][$i])));
diff --git a/apps/files/ajax/delete.php b/apps/files/ajax/delete.php
index ed155de0..161d820f 100644
--- a/apps/files/ajax/delete.php
+++ b/apps/files/ajax/delete.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 
 
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 // Get data
 $dir = stripslashes($_GET["dir"]);
 $files = isset($_GET["file"]) ? stripslashes($_GET["file"]) : stripslashes($_GET["files"]);
 
diff --git a/apps/files/ajax/move.php b/apps/files/ajax/move.php
index 945fe4e7..56171dd0 100644
--- a/apps/files/ajax/move.php
+++ b/apps/files/ajax/move.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 
 
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 // Get data
 $dir = stripslashes($_GET["dir"]);
 $file = stripslashes($_GET["file"]);
 $target = stripslashes($_GET["target"]);
diff --git a/apps/files/ajax/newfile.php b/apps/files/ajax/newfile.php
index edb78414..7236deb6 100644
--- a/apps/files/ajax/newfile.php
+++ b/apps/files/ajax/newfile.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 
 
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 // Get the params
 $dir = isset( $_POST['dir'] ) ? stripslashes($_POST['dir']) : '';
 $filename = isset( $_POST['filename'] ) ? stripslashes($_POST['filename']) : '';
 $content = isset( $_POST['content'] ) ? $_POST['content'] : '';
diff --git a/apps/files/ajax/newfolder.php b/apps/files/ajax/newfolder.php
index c5c37914..ae92bcf0 100644
--- a/apps/files/ajax/newfolder.php
+++ b/apps/files/ajax/newfolder.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 
 
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 // Get the params
 $dir = isset( $_POST['dir'] ) ? stripslashes($_POST['dir']) : '';
 $foldername = isset( $_POST['foldername'] ) ? stripslashes($_POST['foldername']) : '';
 
diff --git a/apps/files/ajax/rename.php b/apps/files/ajax/rename.php
index e2fa3d54..8e98308e 100644
--- a/apps/files/ajax/rename.php
+++ b/apps/files/ajax/rename.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 
 
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 // Get data
 $dir = stripslashes($_GET["dir"]);
 $file = stripslashes($_GET["file"]);
 $newname = stripslashes($_GET["newname"]);
diff --git a/apps/files_sharing/ajax/email.php b/apps/files_sharing/ajax/email.php
index edf9eca4..e931e5f7 100644
--- a/apps/files_sharing/ajax/email.php
+++ b/apps/files_sharing/ajax/email.php
@@ -1,7 +1,8 @@
 <?php
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 OCP\JSON::checkAppEnabled('files_sharing');
 $user = OCP\USER::getUser();
 // TODO translations
 $type = (strpos($_POST['file'], '.') === false) ? 'folder' : 'file';
 $subject = $user.' shared a '.$type.' with you';
diff --git a/apps/files_sharing/ajax/setpermissions.php b/apps/files_sharing/ajax/setpermissions.php
index 2f4c5da9..13daab73 100644
--- a/apps/files_sharing/ajax/setpermissions.php
+++ b/apps/files_sharing/ajax/setpermissions.php
@@ -1,10 +1,11 @@
 <?php
 require_once(OC::$APPSROOT . '/apps/files_sharing/lib_share.php');
 
 OCP\JSON::checkAppEnabled('files_sharing');
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 $source = '/'.OCP\USER::getUser().'/files'.$_POST['source'];
 $uid_shared_with = $_POST['uid_shared_with'];
 $permissions = $_POST['permissions'];
 OC_Share::setPermissions($source, $uid_shared_with, $permissions);
diff --git a/apps/files_sharing/ajax/share.php b/apps/files_sharing/ajax/share.php
index ec3c2599..fb28caf7 100644
--- a/apps/files_sharing/ajax/share.php
+++ b/apps/files_sharing/ajax/share.php
@@ -1,10 +1,11 @@
 <?php
 require_once(OC::$APPSROOT . '/apps/files_sharing/lib_share.php');
 
 OCP\JSON::checkAppEnabled('files_sharing');
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 $userDirectory = '/'.OCP\USER::getUser().'/files';
 $sources = explode(';', $_POST['sources']);
 $uid_shared_with = $_POST['uid_shared_with'];
 $permissions = $_POST['permissions'];
diff --git a/apps/files_sharing/ajax/toggleresharing.php b/apps/files_sharing/ajax/toggleresharing.php
index 673f00c5..ab8e82c8 100644
--- a/apps/files_sharing/ajax/toggleresharing.php
+++ b/apps/files_sharing/ajax/toggleresharing.php
@@ -1,7 +1,9 @@
 <?php
 
+OCP\JSON::callCheck();
+
 OCP\JSON::checkAppEnabled('files_sharing');
 OCP\JSON::checkAdminUser();
 if ($_POST['resharing'] == true) {
 	OCP\Config::setAppValue('files_sharing', 'resharing', 'yes');
 } else {
diff --git a/apps/files_sharing/ajax/togglesharewitheveryone.php b/apps/files_sharing/ajax/togglesharewitheveryone.php
index dc1105f2..96c43711 100644
--- a/apps/files_sharing/ajax/togglesharewitheveryone.php
+++ b/apps/files_sharing/ajax/togglesharewitheveryone.php
@@ -1,7 +1,9 @@
 <?php
 
+OCP\JSON::callCheck();
+
 OCP\JSON::checkAppEnabled('files_sharing');
 OCP\JSON::checkAdminUser();
 if ($_POST['allowSharingWithEveryone'] == true) {
 	OCP\Config::setAppValue('files_sharing', 'allowSharingWithEveryone', 'yes');
 } else {
diff --git a/apps/files_sharing/ajax/unshare.php b/apps/files_sharing/ajax/unshare.php
index 9088bf42..d291b719 100644
--- a/apps/files_sharing/ajax/unshare.php
+++ b/apps/files_sharing/ajax/unshare.php
@@ -1,10 +1,11 @@
 <?php
 require_once(OC::$APPSROOT . '/apps/files_sharing/lib_share.php');
 
 OCP\JSON::checkAppEnabled('files_sharing');
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 $source = '/'.OCP\USER::getUser().'/files'.$_POST['source'];
 $uid_shared_with = $_POST['uid_shared_with'];
 OC_Share::unshare($source, $uid_shared_with);
 
diff --git a/apps/files_texteditor/ajax/savefile.php b/apps/files_texteditor/ajax/savefile.php
index f789112d..aa24d07e 100644
--- a/apps/files_texteditor/ajax/savefile.php
+++ b/apps/files_texteditor/ajax/savefile.php
@@ -24,10 +24,11 @@
  
 
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 // Get paramteres
 $filecontents = isset($_POST['filecontents']) ? $_POST['filecontents'] : false;
 $path = isset($_POST['path']) ? $_POST['path'] : '';
 $mtime = isset($_POST['mtime']) ? $_POST['mtime'] : '';
diff --git a/apps/files_versions/ajax/rollbackVersion.php b/apps/files_versions/ajax/rollbackVersion.php
index 127592f3..77c6102e 100644
--- a/apps/files_versions/ajax/rollbackVersion.php
+++ b/apps/files_versions/ajax/rollbackVersion.php
@@ -1,8 +1,9 @@
 <?php
 
 OCP\JSON::checkAppEnabled('files_versions');
+OCP\JSON::callCheck();
 
 require_once('apps/files_versions/versions.php');
 
 $userDirectory = "/".OCP\USER::getUser()."/files";
 
diff --git a/apps/gallery/ajax/createAlbum.php b/apps/gallery/ajax/createAlbum.php
index 61e2e9ae..e13dac6a 100644
--- a/apps/gallery/ajax/createAlbum.php
+++ b/apps/gallery/ajax/createAlbum.php
@@ -22,10 +22,11 @@
 */
 
  
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('gallery');
+OCP\JSON::callCheck();
 
 OC_Gallery_Album::create(OCP\USER::getUser(), $_GET['album_name']);
 
 OCP\JSON::success(array('name' => $_GET['album_name']));
 
diff --git a/apps/gallery/ajax/sharing.php b/apps/gallery/ajax/sharing.php
index 12233201..c3d5989a 100644
--- a/apps/gallery/ajax/sharing.php
+++ b/apps/gallery/ajax/sharing.php
@@ -20,10 +20,11 @@
 * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 * 
 */
 
  
+OCP\JSON::callCheck();
 
 if (!isset($_GET['token']) || !isset($_GET['operation'])) {
   OCP\JSON::error(array('cause' => 'Not enought arguments'));
   exit;
 }
diff --git a/apps/tasks/ajax/addtask.php b/apps/tasks/ajax/addtask.php
index 9f35e7f2..188e1792 100644
--- a/apps/tasks/ajax/addtask.php
+++ b/apps/tasks/ajax/addtask.php
@@ -1,10 +1,11 @@
 <?php
 
 // Init owncloud
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('tasks');
+OCP\JSON::callCheck();
 
 $calendars = OC_Calendar_Calendar::allCalendars(OCP\User::getUser(), true);
 $first_calendar = reset($calendars);
 $cid = $first_calendar['id'];
 
diff --git a/apps/tasks/ajax/addtaskform.php b/apps/tasks/ajax/addtaskform.php
index d86232e2..2795f393 100644
--- a/apps/tasks/ajax/addtaskform.php
+++ b/apps/tasks/ajax/addtaskform.php
@@ -1,10 +1,11 @@
 <?php
 
 // Init owncloud
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('tasks');
+OCP\JSON::callCheck();
 
 $calendars = OC_Calendar_Calendar::allCalendars(OCP\User::getUser(), true);
 $category_options = OC_Calendar_App::getCategoryOptions();
 $percent_options = range(0, 100, 10);
 $priority_options = OC_Task_App::getPriorityOptions();
diff --git a/apps/tasks/ajax/delete.php b/apps/tasks/ajax/delete.php
index e29add9b..cc22c3e3 100644
--- a/apps/tasks/ajax/delete.php
+++ b/apps/tasks/ajax/delete.php
@@ -21,10 +21,11 @@
  */
 
 // Init owncloud
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('tasks');
+OCP\JSON::callCheck();
 
 $id = $_POST['id'];
 $task = OC_Calendar_App::getEventObject( $id );
 
 OC_Calendar_Object::delete($id);
diff --git a/apps/tasks/ajax/edittask.php b/apps/tasks/ajax/edittask.php
index edcc8a7c..77ecff13 100644
--- a/apps/tasks/ajax/edittask.php
+++ b/apps/tasks/ajax/edittask.php
@@ -1,10 +1,11 @@
 <?php
 
 // Init owncloud
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('tasks');
+OCP\JSON::callCheck();
 
 $l10n = new OC_L10N('tasks');
 
 $id = $_POST['id'];
 $vcalendar = OC_Calendar_App::getVCalendar($id);

Fixed code: OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();

OCP\JSON::callCheck();

 OCP\JSON::callCheck();

 OCP\JSON::callCheck();

 OCP\JSON::callCheck();

OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();

OCP\JSON::callCheck();

OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();