diff options
| author | Michael Save <savetheinternet@tinyboard.org> | 2012-08-27 15:19:05 +1000 |
|---|---|---|
| committer | Michael Save <savetheinternet@tinyboard.org> | 2012-08-27 15:19:05 +1000 |
| commit | 6229b82a43e808d4ead53f841f9cbed3e7393366 (patch) | |
| tree | 29cd12af964a8e2d4fc7c9f6c0737ae00622d713 /templates | |
| parent | 4a9d497a949c941900dddf8858edb464f1d72f7f (diff) | |
CSRF protection
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/mod/ban_form.html | 1 | ||||
| -rw-r--r-- | templates/mod/confirm.html | 4 | ||||
| -rw-r--r-- | templates/mod/move.html | 5 |
3 files changed, 6 insertions, 4 deletions
diff --git a/templates/mod/ban_form.html b/templates/mod/ban_form.html index 5d5f2b81..edc1ab3b 100644 --- a/templates/mod/ban_form.html +++ b/templates/mod/ban_form.html @@ -5,6 +5,7 @@ {% endif %} <form action="{{ action }}" method="post"> + <input type="hidden" name="token" value="{{ token }}"> {% if redirect %} <input type="hidden" name="redirect" value="{{ redirect|e }}"> {% endif %} diff --git a/templates/mod/confirm.html b/templates/mod/confirm.html index 6dc4d66a..65e43eb3 100644 --- a/templates/mod/confirm.html +++ b/templates/mod/confirm.html @@ -1,7 +1,7 @@ <p style="text-align:center;font-size:1.1em"> - {% trans 'Are you sure you want to do that?' %} <a href="?/{{ request }}">{% trans 'Click to proceed to' %} ?/{{ request }}</a>. + {% trans 'Are you sure you want to do that?' %} <a href="?/{{ request }}/{{ token }}">{% trans 'Click to proceed to' %} ?/{{ request }}</a>. </p> <p class="unimportant" style="text-align:center"> - {% trans 'You are seeing this message because we were unable to serve a confirmation dialog, probably due to Javascript being disabled.' %} + {% trans 'You are probably seeing this message because Javascript being disabled. This is a necessary security measure to prevent CSRF attacks.' %} </p> diff --git a/templates/mod/move.html b/templates/mod/move.html index 802903b2..59bd60f6 100644 --- a/templates/mod/move.html +++ b/templates/mod/move.html @@ -1,4 +1,5 @@ -<form action="?/{{ board }}/move/{{ post }}" method="post"> +<form action="?/{{ board }}/move/{{ post }}" method="post"> + <input type="hidden" name="token" value="{{ token }}"> <table> <tr> <th> @@ -23,7 +24,7 @@ <ul style="list-style:none;padding:0"> {% for targetboard in boards if targetboard.uri != board %} <li> - <input type="radio" name="board" value="{{ targetboard.uri }}" id="ban-board-{{ targetboard.uri }}"> + <input type="radio" name="board" value="{{ targetboard.uri }}" id="ban-board-{{ targetboard.uri }}" {% if boards|count == 2 %}checked{% endif %}> <label style="display:inline" for="ban-board-{{ targetboard.uri }}"> {{ config.board_abbreviation|sprintf(targetboard.uri) }} - {{ targetboard.title|e }} </label> |