require CSRF token for Article/redirect

classes/article.php

@@ -2,7 +2,7 @@
 class Article extends Handler_Protected {
 
 	function csrf_ignore($method) {
-		$csrf_ignored = array("redirect", "editarticletags");
+		$csrf_ignored = array("editarticletags");
 
 		return array_search($method, $csrf_ignored) !== false;
 	}

js/Article.js

@@ -133,9 +133,11 @@ const Article = {
 	openInNewWindow: function (id) {
 		const w = window.open("");
 
+		/* global __csrf_token */
+
 		if (w) {
 			w.opener = null;
-			w.location = "backend.php?op=article&method=redirect&id=" + id;
+			w.location = "backend.php?op=article&method=redirect&id=" + id + "&csrf_token=" + __csrf_token;
 
 			Headlines.toggleUnread(id, 0);
 		}