Index: flag.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/flag/Attic/flag.module,v
retrieving revision 1.1.2.58
diff -u -r1.1.2.58 flag.module
--- flag.module	3 Oct 2008 15:32:09 -0000	1.1.2.58
+++ flag.module	3 Oct 2008 15:46:09 -0000
@@ -664,7 +664,13 @@
  *
  * Used both for the regular callback as well as the JS version.
  */
-function flag_page($action, $flag_name, $content_id) {
+function flag_page($action, $flag_name, $content_id, $token) {
+  if (!flag_check_token($token, $content_id)) {
+    drupal_set_message(t('Bad token. You seem to have followed an invalid link.'), 'error');
+    drupal_access_denied();
+    return;
+  }
+  
   $result = flag($action, $flag_name, $content_id);
   $js = isset($_REQUEST['js']);
 
@@ -837,7 +843,8 @@
 
   $variables['setup'] = $first_time;
   $first_time = FALSE;
-  $variables['link_href'] = check_url(url("flag/$action/$flag->name/$content_id", drupal_get_destination()));
+  $token = flag_get_token($content_id);
+  $variables['link_href'] = check_url(url("flag/$action/$flag->name/$content_id/$token", drupal_get_destination()));
   $variables['link_text'] = strip_tags($flag->get_label($action . '_short', $content_id), '<em><strong><img>');
   $variables['link_title'] = strip_tags($flag->get_label($action . '_long', $content_id));
   $variables['flag_name_css'] = str_replace('_', '-', $flag->name);
@@ -1190,3 +1197,16 @@
   return $flag->theme($flag->is_flagged($content_id) ? 'unflag' : 'flag', $content_id);
 }
 
+/**
+ * Get a private token used to protect links from spoofing - CSRF.
+ */
+function flag_get_token($nid) {
+  return drupal_get_token($nid);
+}
+
+/**
+ * Check to see if a token value matches the specified node.
+ */
+function flag_check_token($token, $seed) {
+  return drupal_get_token($seed) == $token;
+}