ci-bonfire/Bonfire — pull request #548 by sourcejedi (2012-08-22 13:58:21+00:00)
Title: Cursory audit #2: controller public methods - and CSRF

1. "All controllers: Unpublish internal functions".

Looked through the public methods of controllers, for functions that didn't need to be public. Seems like a no-brainer for access control. I found a couple of minor fixes in the process, and some dead code as well - these are split out as preparatory commits.

2. "Turn 'unsafe' GET links into POST form buttons."

This will allow the remaining, legitimately public methods to be protected against CSRF. This was a second pass, and I didn't manage to find them all in one go. Hopefully I've got them all now. I haven't protected logout - it would have meant adding more and duplicated code.

Then Sean reminded me that CodeIgniter's CSRF protection actually has to be enabled. So there's a commit for that as well :-).