From aa2d32eb613e54cf278a7b9b88216479af0d2c50 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@owncloud.com>
Date: Wed, 5 Nov 2014 09:56:22 +0100
Subject: [PATCH] Add requesttoken

---
 ajax/import.php        | 6 ++++--
 templates/settings.php | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/ajax/import.php b/ajax/import.php
index 5bf8bfe9..670dde46 100644
--- a/ajax/import.php
+++ b/ajax/import.php
@@ -1,7 +1,9 @@
 <?php
 
-OCP\App::checkAppEnabled('bookmarks');
-
+// Check if we are a user
+OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
+OCP\JSON::checkAppEnabled('bookmarks');
 
 $l = new OC_l10n('bookmarks');
 if(empty($_FILES)) {
diff --git a/templates/settings.php b/templates/settings.php
index d86b0958..8d036398 100644
--- a/templates/settings.php
+++ b/templates/settings.php
@@ -5,6 +5,7 @@
  * later.
  * See the COPYING-README file.
  */
+/** @var array $_ */
 ?>
 
 <fieldset class="personalblock">
@@ -14,6 +15,7 @@
 
 <form id="import_bookmark" action="<?php print_unescaped(OCP\Util::linkTo( "bookmarks", "ajax/import.php" ));?>"
  method="post" enctype="multipart/form-data">
+	<input type="hidden" name="requesttoken" value="<?php p($_['requesttoken']) ?>"/>
 	<fieldset class="personalblock">
 		<?php if(isset($_['error'])): ?>
 			<h3><?php p($_['error']['error']); ?></h3>