Changeset 856

Show
Ignore:
Timestamp:
05/06/08 10:01:07 (3 months ago)
Author:
seancribbs
Message:

Address CSRF vulnerabilities in forms.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/radiant/app/controllers/application.rb

    r820 r856  
    55   
    66  filter_parameter_logging :password, :password_confirmation 
     7   
     8  protect_from_forgery :secret => "sweet-harmonious-biscuits" 
    79   
    810  before_filter :set_current_user 

  • trunk/radiant/app/controllers/site_controller.rb

    r716 r856  
    11class SiteController < ApplicationController 
    22  session :off 
     3  skip_before_filter :verify_authenticity_token 
    34   
    45  no_login_required 

  • trunk/radiant/app/views/admin/layout/edit.html.erb

    r785 r856  
    55<% end -%> 
    66 
    7 <form method="post" action=""> 
     7<% form_tag do %> 
    88  <%= hidden_field "layout", "lock_version" %> 
    99  <div class="form-area"> 
    …… 
    3535    <%= save_model_button(@layout) %> <%= save_model_and_continue_editing_button(@layout) %> or <%= link_to "Cancel", layout_index_url %> 
    3636  </p> 
    37 </form> 
     37<% end %> 
    3838 
    3939<%= focus 'layout_name' %> 

  • trunk/radiant/app/views/admin/layout/remove.html.erb

    r690 r856  
    1313</table> 
    1414 
    15 <form method="post" action=""> 
     15<% form_tag do %> 
    1616  <p class="buttons"><%= submit_tag "Delete Layout", :class => 'button' %> or <%= link_to 'Cancel', layout_index_url %></p> 
    17 </form> 
     17<% end %> 

  • trunk/radiant/app/views/admin/page/edit.html.erb

    r759 r856  
    5454<% end -%> 
    5555 
    56 <form method="post" action="" enctype="multipart/form-data"> 
     56<% form_tag({}, {:multipart => true}) do %> 
    5757  <%= hidden_field "page", "lock_version" %> 
    5858  <div class="form-area"> 
    …… 
    105105    <%= save_model_button(@page) %> <%= save_model_and_continue_editing_button(@page) %> or <%= link_to "Cancel", page_index_url %> 
    106106  </p> 
    107 </form> 
     107<% end %> 
    108108 
    109109<% content_for :popups do -%> 

  • trunk/radiant/app/views/admin/page/remove.html.erb

    r690 r856  
    1010</table> 
    1111 
    12 <form method="post" action=""> 
     12<% form_tag do %> 
    1313  <p class="buttons"><%= submit_tag "Delete #{pages}", :class => 'button' %> or <%= link_to 'Cancel', page_index_url %></p> 
    14 </form> 
     14<% end %> 

  • trunk/radiant/app/views/admin/snippet/edit.html.erb

    r690 r856  
    55<% end -%> 
    66 
    7 <form method="post" action=""> 
     7<% form_tag do %> 
    88  <%= hidden_field "snippet", "lock_version" %> 
    99  <div class="form-area"> 
    …… 
    2525    <%= save_model_button(@snippet) %> <%= save_model_and_continue_editing_button(@snippet) %> or <%= link_to "Cancel", snippet_index_url %> 
    2626  </p> 
    27 </form> 
     27<% end %> 
    2828 
    2929<%= focus 'snippet_name' %> 

  • trunk/radiant/app/views/admin/snippet/remove.html.erb

    r690 r856  
    1212</table> 
    1313 
    14 <form method="post" action=""> 
     14<% form_tag do %> 
    1515  <p class="buttons"><%= submit_tag "Delete Snippet", :class => 'button' %> or <%= link_to 'Cancel', snippet_index_url %></p> 
    16 </form> 
     16<% end %> 

  • trunk/radiant/app/views/admin/user/edit.html.erb

    r785 r856  
    55<% end -%> 
    66 
    7 <form method="post" action=""> 
     7<% form_tag do %> 
    88  <%= hidden_field "user", "lock_version" %> 
    99  <table class="fieldset" cellpadding="0" cellspacing="0" border="0"> 
    …… 
    5050    <%= save_model_button(@user) %> <%= save_model_and_continue_editing_button(@user) %> or <%= link_to "Cancel", user_index_url %> 
    5151  </p> 
    52 </form> 
     52<% end %> 
    5353 
    5454<%= focus 'user_name' %> 

  • trunk/radiant/app/views/admin/user/preferences.html.erb

    r822 r856  
    11<h1>User Preferences</h1> 
    22 
    3 <form method="post" action=""> 
     3<% form_tag do %> 
    44  <table class="fieldset" cellpadding="0" cellspacing="0" border="0"> 
    55    <tr> 
    …… 
    2121    <%= save_model_button(@user) %> or <%= link_to "Cancel", admin_url %> 
    2222  </p> 
    23 </form> 
     23<% end %> 
    2424 
    2525<script type="text/javascript"> 

  • trunk/radiant/app/views/admin/user/remove.html.erb

    r690 r856  
    1212</table> 
    1313 
    14 <form method="post"> 
     14<% form_tag do %> 
    1515  <p class="buttons"><%= submit_tag "Delete User", :class => 'button' %> or <%= link_to 'Cancel', user_index_url %></p> 
    16 </form> 
     16<% end %> 

  • trunk/radiant/app/views/admin/welcome/login.html.erb

    r690 r856  
    3838  <h1>Please Login</h1> 
    3939 
    40   <form method="post" action=""> 
     40  <% form_tag login_url do %> 
    4141    <p><label for="user_login">Username</label> 
    4242      <%= text_field "user", "login", :class => 'textbox', :value => '', :maxlength => 40 %></p> 
    …… 
    4646      <%= submit_tag 'Login', :class => 'button' %> 
    4747    </p> 
    48   </form> 
     48  <% end %> 
    4949</div> 
    5050