From 6229b82a43e808d4ead53f841f9cbed3e7393366 Mon Sep 17 00:00:00 2001
From: Michael Save <savetheinternet@tinyboard.org>
Date: Mon, 27 Aug 2012 15:19:05 +1000
Subject: CSRF protection

---
 templates/mod/ban_form.html | 1 +
 templates/mod/confirm.html  | 4 ++--
 templates/mod/move.html     | 5 +++--
 3 files changed, 6 insertions(+), 4 deletions(-)

(limited to 'templates')

diff --git a/templates/mod/ban_form.html b/templates/mod/ban_form.html
index 5d5f2b81..edc1ab3b 100644
--- a/templates/mod/ban_form.html
+++ b/templates/mod/ban_form.html
@@ -5,6 +5,7 @@
 {% endif %}
 
 <form action="{{ action }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	{% if redirect %}
 		<input type="hidden" name="redirect" value="{{ redirect|e }}">
 	{% endif %}
diff --git a/templates/mod/confirm.html b/templates/mod/confirm.html
index 6dc4d66a..65e43eb3 100644
--- a/templates/mod/confirm.html
+++ b/templates/mod/confirm.html
@@ -1,7 +1,7 @@
 <p style="text-align:center;font-size:1.1em">
-	{% trans 'Are you sure you want to do that?' %} <a href="?/{{ request }}">{% trans 'Click to proceed to' %} ?/{{ request }}</a>.
+	{% trans 'Are you sure you want to do that?' %} <a href="?/{{ request }}/{{ token }}">{% trans 'Click to proceed to' %} ?/{{ request }}</a>.
 </p>
 <p class="unimportant" style="text-align:center">
-	{% trans 'You are seeing this message because we were unable to serve a confirmation dialog, probably due to Javascript being disabled.' %}
+	{% trans 'You are probably seeing this message because Javascript being disabled. This is a necessary security measure to prevent CSRF attacks.' %}
 </p>
 
diff --git a/templates/mod/move.html b/templates/mod/move.html
index 802903b2..59bd60f6 100644
--- a/templates/mod/move.html
+++ b/templates/mod/move.html
@@ -1,4 +1,5 @@
-<form action="?/{{ board }}/move/{{ post }}" method="post">	
+<form action="?/{{ board }}/move/{{ post }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>
@@ -23,7 +24,7 @@
 				<ul style="list-style:none;padding:0">
 					{% for targetboard in boards if targetboard.uri != board %}
 						<li>
-							<input type="radio" name="board" value="{{ targetboard.uri }}" id="ban-board-{{ targetboard.uri }}"> 
+							<input type="radio" name="board" value="{{ targetboard.uri }}" id="ban-board-{{ targetboard.uri }}" {% if boards|count == 2 %}checked{% endif %}> 
 							<label style="display:inline" for="ban-board-{{ targetboard.uri }}">
 								{{ config.board_abbreviation|sprintf(targetboard.uri) }} - {{ targetboard.title|e }}
 							</label>
-- 
cgit v1.3