<?php

namespace wcf\action;

use wcf\system\exception\InvalidSecurityTokenException;
use wcf\system\WCF;

/**
 * Extends AbstractAction by a function to validate a given security token.
 * A missing or invalid token will be result in a throw of a IllegalLinkException.
 *
 * @author  Marcel Werk
 * @copyright   2001-2019 WoltLab GmbH
 * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
 * @package WoltLabSuite\Core\Action
 */
abstract class AbstractSecureAction extends AbstractAction
{
    /**
     * @inheritDoc
     */
    public function readParameters()
    {
        parent::readParameters();

        $this->checkSecurityToken();
    }

    /**
     * Validates the security token.
     */
    protected function checkSecurityToken()
    {
        if (!isset($_REQUEST['t']) || !WCF::getSession()->checkSecurityToken($_REQUEST['t'])) {
            throw new InvalidSecurityTokenException();
        }
    }
}

<?php

namespace wcf\action;

use wcf\system\exception\InvalidSecurityTokenException;
use wcf\system\WCF;

/**
 * Extends AbstractAction by a function to validate a given security token.
 * A missing or invalid token will be result in a throw of a IllegalLinkException.
 *
 * @author  Marcel Werk
 * @copyright   2001-2019 WoltLab GmbH
 * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
 * @package WoltLabSuite\Core\Action
 */
abstract class AbstractSecureAction extends AbstractAction
{
    /**
     * @inheritDoc
     */
    public function readParameters()
    {
        parent::readParameters();

        // check security token (unless it is a guest)
        if (WCF::getSession()->userID) {
            $this->checkSecurityToken();
        }
    }

    /**
     * Validates the security token.
     */
    protected function checkSecurityToken()
    {
        if (!isset($_REQUEST['t']) || !WCF::getSession()->checkSecurityToken($_REQUEST['t'])) {
            throw new InvalidSecurityTokenException();
        }
    }
}

--- 
+++ 
@@ -23,10 +23,7 @@
     {
         parent::readParameters();
 
-        // check security token (unless it is a guest)
-        if (WCF::getSession()->userID) {
-            $this->checkSecurityToken();
-        }
+        $this->checkSecurityToken();
     }
 
     /**
Revert "Ignore security token for guests"

Due to the age of this commit it's a bit unclear why exactly it was necessary
at that time, but records indicate that it was related to the URL based session
system (`?s=…`) in combination with with virtual sessions effectively changing
the session ID during login, the `SID` constants being constant and the CSRF
token being stored in the session.

As none of this applies any longer, this workaround should no longer be
necessary and thus reverted. It certainly violates the principle of least
astonishment, because it only applies to AbstractSecureAction, but not forms
and it's questionable from a security perspective.

This reverts commit e5c2467f717632b47f935a0e59a310de2e2867f3.
