xpressengine / xe-core

		// check CSRF for non-GET actions

		$use_check_csrf = isset($xml_info->action->{$this->act}) && $xml_info->action->{$this->act}->check_csrf !== 'false';

		if($use_check_csrf && $_SERVER['REQUEST_METHOD'] !== 'GET' && Context::isInstalled() && !checkCSRF())

		{

			$this->error = 'msg_invalid_request';

			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);

			$oMessageObject->setError(-1);

			$oMessageObject->setMessage($this->error);

			$oMessageObject->dispMessage();

			return $oMessageObject;

		}

		// Admin ip

		if($kind == 'admin' && $_SESSION['denied_admin'] == 'Y')

				// check CSRF for non-GET actions

				$use_check_csrf = isset($xml_info->action->{$this->act}) && $xml_info->action->{$this->act}->check_csrf !== 'false';

				if($use_check_csrf && $_SERVER['REQUEST_METHOD'] !== 'GET' && Context::isInstalled() && !checkCSRF())

				{

					$this->error = 'msg_invalid_request';

					$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);

					$oMessageObject->setError(-1);

					$oMessageObject->setMessage($this->error);

					$oMessageObject->dispMessage();

					return $oMessageObject;

				}

				// SECISSUE also check foward act method

				// check REQUEST_METHOD in controller