diff options
| author | luccioman <luccioman@users.noreply.github.com> | 2017-03-26 11:48:00 +0200 |
|---|---|---|
| committer | luccioman <luccioman@users.noreply.github.com> | 2017-03-26 11:48:00 +0200 |
| commit | cde237b68763c542da20038e5f62bea341ae1d37 (patch) | |
| tree | a8a55d4425e9ad778e5737d920458a0dd8639abc /htroot/IndexControlRWIs_p.html | |
| parent | df5970df6d4de27ef96641aadc2591c219e87a36 (diff) | |
Enforced access controls on some administrative actions.
- ensure use of HTTP POST method : HTTP GET should only be used for
information retrieval and not to perform server side effect operations
(see HTTP standard https://tools.ietf.org/html/rfc7231#section-4.2.1)
- a transaction token is now required for these administrative form
submissions to ensure the request can not be included in an external
site and performed silently/by mistake by the user browser
Diffstat (limited to 'htroot/IndexControlRWIs_p.html')
| -rw-r--r-- | htroot/IndexControlRWIs_p.html | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/htroot/IndexControlRWIs_p.html b/htroot/IndexControlRWIs_p.html index 90f5afaa8..ef9f62738 100644 --- a/htroot/IndexControlRWIs_p.html +++ b/htroot/IndexControlRWIs_p.html @@ -28,6 +28,7 @@ #(limitations)#::
<form action="IndexControlRWIs_p.html" method="post" enctype="multipart/form-data" accept-charset="UTF-8">
+ <input type="hidden" name="transactionToken" value="#[transactionToken]#" />
<fieldset><legend>Limitations</legend>
<dl>
<dt class="TableCellDark">Index Reference Size</dt>
@@ -47,6 +48,7 @@ <p>No entry for word hash #[wordhash]#</p>::
<p>Search result:
<form name="selection" action="IndexControlRWIs_p.html" method="post" enctype="multipart/form-data">
+ <input type="hidden" name="transactionToken" value="#[transactionToken]#" />
<table border="0">
<tr class="TableHeader">
<td style="background-color:#FFFFFF"> </td>
|