friendica/friendica — pull request #540 by Leberwurscht (2012-12-01 00:32:34+00:00)
Title: Cross site request forgery hole

Currently, users can be tricked into posting something by sending them URLs like /api/statuses/update?status=CSRF (or embedding images with this src attribute).

To avoid that, I disallowed logged in users using the API. Only if api_login is called, $_SESSION["allow_api"] is set to true. After that, usage of the API is permitted.