1 files changed, 43 insertions, 42 deletions
diff --git a/mod/notifications/actions/save.php b/mod/notifications/actions/save.php
index 112b1a74c..3fe0001a3 100644
--- a/mod/notifications/actions/save.php
+++ b/mod/notifications/actions/save.php
@@ -1,42 +1,43 @@
-<?php
-
-	/**
-	 * Elgg notifications
-	 * 
-	 * @package ElggNotifications
-	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
-	 * @author Curverider Ltd
-	 * @copyright Curverider Ltd 2008-2009
-	 * @link http://elgg.com/
-	 */
-
-	// Restrict to logged in users
-		gatekeeper();
-		
-		global $SESSION;
-		
-		global $NOTIFICATION_HANDLERS;
-		foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-			$subscriptions[$method] = get_input($method.'subscriptions');
-			$personal[$method] = get_input($method.'personal');
-			$collections[$method] = get_input($method.'collections');
-			
-			$metaname = 'collections_notifications_preferences_' . $method;
-			$_SESSION['user']->$metaname = $collections[$method];
-			set_user_notification_setting($_SESSION['user']->guid, $method, ($personal[$method] == '1') ? true : false);
-			remove_entity_relationships($SESSION['user']->guid,'notify' . $method, false, 'user');
-		}
-		
-	// Add new ones
-		foreach($subscriptions as $key => $subscription)
-		if (is_array($subscription) && !empty($subscription)) {
-			foreach($subscription as $subscriptionperson) {
-				add_entity_relationship($_SESSION['user']->guid, 'notify' . $key, $subscriptionperson);
-			}
-		}
-		
-		system_message(elgg_echo('notifications:subscriptions:success'));
-		
-		forward($_SERVER['HTTP_REFERER']);
-
-?>
-\ No newline at end of file
+<?php
+
+/**
+ * Elgg notifications
+ *
+ * @package ElggNotifications
+ */
+
+$current_user = elgg_get_logged_in_user_entity();
+
+$guid = (int) get_input('guid', 0);
+if (!$guid || !($user = get_entity($guid))) {
+	forward();
+}
+if (($user->guid != $current_user->guid) && !$current_user->isAdmin()) {
+	forward();
+}
+
+global $NOTIFICATION_HANDLERS;
+$subscriptions = array();
+foreach($NOTIFICATION_HANDLERS as $method => $foo) {
+	$subscriptions[$method] = get_input($method.'subscriptions');
+	$personal[$method] = get_input($method.'personal');
+	$collections[$method] = get_input($method.'collections');
+
+	$metaname = 'collections_notifications_preferences_' . $method;
+	$user->$metaname = $collections[$method];
+	set_user_notification_setting($user->guid, $method, ($personal[$method] == '1') ? true : false);
+	remove_entity_relationships($user->guid, 'notify' . $method, false, 'user');
+}
+
+// Add new ones
+foreach($subscriptions as $key => $subscription) {
+	if (is_array($subscription) && !empty($subscription)) {
+		foreach($subscription as $subscriptionperson) {
+			add_entity_relationship($user->guid, 'notify' . $key, $subscriptionperson);
+		}
+	}
+}
+
+system_message(elgg_echo('notifications:subscriptions:success'));
+
+forward(REFERER);