diff options
| author | luccioman <luccioman@users.noreply.github.com> | 2017-03-26 11:48:00 +0200 |
|---|---|---|
| committer | luccioman <luccioman@users.noreply.github.com> | 2017-03-26 11:48:00 +0200 |
| commit | cde237b68763c542da20038e5f62bea341ae1d37 (patch) | |
| tree | a8a55d4425e9ad778e5737d920458a0dd8639abc /htroot/ConfigUpdate_p.html | |
| parent | df5970df6d4de27ef96641aadc2591c219e87a36 (diff) | |
Enforced access controls on some administrative actions.
- ensure use of HTTP POST method : HTTP GET should only be used for
information retrieval and not to perform server side effect operations
(see HTTP standard https://tools.ietf.org/html/rfc7231#section-4.2.1)
- a transaction token is now required for these administrative form
submissions to ensure the request can not be included in an external
site and performed silently/by mistake by the user browser
Diffstat (limited to 'htroot/ConfigUpdate_p.html')
| -rw-r--r-- | htroot/ConfigUpdate_p.html | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/htroot/ConfigUpdate_p.html b/htroot/ConfigUpdate_p.html index 2be2f3ee6..e5228281f 100644 --- a/htroot/ConfigUpdate_p.html +++ b/htroot/ConfigUpdate_p.html @@ -1,7 +1,6 @@ -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"> +<!DOCTYPE html> +<html> <head> - #(forwardToSteering)#::<meta http-equiv="REFRESH" content="0; url=/Steering.html?update=1&releaseinstall=#[release]#" />#(/forwardToSteering)# <title>YaCy '#[clientname]#': System Update</title> #%env/templates/metas.template%# </head> @@ -35,10 +34,11 @@ #(/downloadError)# </p></form></dd> <dt><br />Downloaded Releases</dt> - <dd><form action="ConfigUpdate_p.html" method="get" accept-charset="UTF-8"><p> + <dd><form action="Steering.html" method="post" accept-charset="UTF-8"><p> #(downloadsAvailable)# No downloaded releases available for deployment. :: + <input type="hidden" name="update" value="1"/> <select name="releaseinstall"> #(/downloadsAvailable)# #{downloadedreleases}# @@ -46,8 +46,9 @@ #{/downloadedreleases}# #(downloadsAvailable)#::</select>#(/downloadsAvailable)# #(deployenabled)#::no automated installation on development environments:: + <input type="hidden" name="transactionToken" value="#[transactionToken]#"/> <input type="submit" name="update" class="btn btn-primary" value="Install Release" #(buttonsActive)#disabled="disabled"::#(/buttonsActive)#/> - <input type="submit" name="deleteRelease" class="btn btn-danger" value="Delete Release" #(buttonsActive)#disabled="disabled"::#(/buttonsActive)#/> + <input type="submit" name="deleteRelease" formaction="ConfigUpdate_p.html" class="btn btn-danger" value="Delete Release" #(buttonsActive)#disabled="disabled"::#(/buttonsActive)#/> #(/deployenabled)# </p></form></dd> <dt><br />Automatic Update</dt> |