? mw.patch
Index: flag.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/flag/Attic/flag.module,v
retrieving revision 1.11.2.44
diff -u -F^f -p -r1.11.2.44 flag.module
--- flag.module	30 Sep 2008 03:08:49 -0000	1.11.2.44
+++ flag.module	3 Oct 2008 00:27:41 -0000
@@ -644,7 +644,13 @@ function _flag_clear_cache() {
  *
  * Used both for the regular callback as well as the JS version.
  */
-function flag_page($action, $flag_name, $content_id) {
+function flag_page($action, $flag_name, $content_id, $token) {
+  if (!flag_check_token($token, $content_id)) {
+    drupal_set_message(t('Bad token. You seem to have followed an invalid link.'), 'error');
+    drupal_access_denied();
+    return;
+  }
+  
   $result = flag($action, $flag_name, $content_id);
   $js = isset($_REQUEST['js']);
 
@@ -804,7 +810,8 @@ function template_preprocess_flag(&$vari
 
   $variables['setup'] = $first_time;
   $first_time = FALSE;
-  $variables['link_href'] = check_url(url("flag/$action/$flag->name/$content_id", array('query' => drupal_get_destination())));
+  $token = flag_get_token($content_id);
+  $variables['link_href'] = check_url(url("flag/$action/$flag->name/$content_id/$token", array('query' => drupal_get_destination())));
   $variables['link_text'] = strip_tags($flag->get_label($action . '_short', $content_id), '<em><strong><img>');
   $variables['link_title'] = strip_tags($flag->get_label($action . '_long', $content_id));
   $variables['flag_name_css'] = str_replace('_', '-', $flag->name);
@@ -1122,3 +1129,16 @@ function flag_create_link($flag_name, $c
   return $flag->theme($flag->is_flagged($content_id) ? 'unflag' : 'flag', $content_id);
 }
 
+/**
+ * Get a private token used to protect links from spoofing - CSRF.
+ */
+function flag_get_token($nid) {
+  return drupal_get_token($nid);
+}
+
+/**
+ * Check to see if a token value matches the specified node.
+ */
+function flag_check_token($token, $seed) {
+  return drupal_get_token($seed) == $token;
+}