EllisLab/CodeIgniter — Issue #940: csrf_verify not work on empty $_POST
Author: harryxu
Created: 2012-01-19 05:05:43+00:00
State: open

If I post a page without any form data, like **post** `admin/user/delete/1`, the csrf_verify will not work and the user will be deleted.

May be [this line](https://github.com/EllisLab/CodeIgniter/blob/2.1-stable/system/core/Security.php#L134) should change to:

```
if ($_SERVER['REQUEST_METHOD'] == 'GET' && !isset($_COOKIE[$this->_csrf_cookie_name])
```