Added CSRF crumb to actions requiring confirmation only when POST method is used.

b0f867fc · Francisco Ruiz · 4ec2e08f · b0f867fc
隐藏空白更改
内联并排

Showing with 3 addition and 1 deletion

core/src/main/resources/lib/layout/confirmationLink.jelly core/src/main/resources/lib/layout/confirmationLink.jelly +3 -1

未找到文件。
--- a/core/src/main/resources/lib/layout/confirmationLink.jelly
+++ b/core/src/main/resources/lib/layout/confirmationLink.jelly
@@ -45,7 +45,9 @@ THE SOFTWARE.
                var form = document.createElement('form');
                form.setAttribute('method', post ? 'POST' : 'GET');
                form.setAttribute('action', href);
-                crumb.appendToForm(form);
+                if (post) {
+                    crumb.appendToForm(form);
+                }
                document.body.appendChild(form);
                form.submit();
            }