diff options
| author | luccioman <luccioman@users.noreply.github.com> | 2018-04-18 08:10:51 +0200 |
|---|---|---|
| committer | luccioman <luccioman@users.noreply.github.com> | 2018-04-18 08:10:51 +0200 |
| commit | 8bc36506f238f18a57969336a1c66d3b56ce91c9 (patch) | |
| tree | 808614f1e6cde046461fbf4b638670eca2b4b3ae /htroot/ConfigBasic.html | |
| parent | 02673379df88bdf476b41ab0c5bda99dc3b2fbce (diff) | |
Enforced access controls on basic administration settings pages.
Ensuring http post method is used for operations with server-side
effects (in respect of http semantics), and a valid transaction token is
provided by the user-agent.
Diffstat (limited to 'htroot/ConfigBasic.html')
| -rw-r--r-- | htroot/ConfigBasic.html | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/htroot/ConfigBasic.html b/htroot/ConfigBasic.html index bef5b4775..60f7f7abc 100644 --- a/htroot/ConfigBasic.html +++ b/htroot/ConfigBasic.html @@ -28,7 +28,8 @@ Your YaCy Peer needs some basic information to operate properly </p> - <form action="ConfigBasic.html" method="get" accept-charset="UTF-8"> + <form action="ConfigBasic.html" method="post" accept-charset="UTF-8"> + <input type="hidden" name="transactionToken" value="#[transactionToken]#"/> <ol> <li> <img src="env/grafics/ok.png" height="16" width="16" alt="ok" /> Select a language for the interface:<br /> @@ -46,7 +47,7 @@ </fieldset> </li> <!-- take care that no other items are changed, but also change the former if no js is enabled --> - <script type="text/javascript"> document.write('</form><form action="ConfigBasic.html" method="get">'); </script> + <script type="text/javascript"> document.write('</form><form action="ConfigBasic.html" method="post" accept-charset="UTF-8"><input type="hidden" name="transactionToken" value="#[transactionToken]#"/>');</script> #(setUseCase)#:: |