diff options
| author | Igor Scheller <igor.scheller@igorshp.de> | 2018-11-20 16:02:03 +0100 |
|---|---|---|
| committer | msquare <msquare@notrademark.de> | 2018-11-21 19:24:36 +0100 |
| commit | 944c29b96429ec95ac1371cb33cc43704a60c7b1 (patch) | |
| tree | 7be99e68d8c15fc7e210a4b3ccc44861a8d1de64 /includes/view/Questions_view.php | |
| parent | fd37c9d60ea818dc9a562fa88ff5f9a50132506f (diff) | |
Require POST for sending forms
* Ensure that the form is submitted with a post request
* Replaced several links with forms
Closes #494 (Security Vulnerability)
Diffstat (limited to 'includes/view/Questions_view.php')
| -rw-r--r-- | includes/view/Questions_view.php | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/includes/view/Questions_view.php b/includes/view/Questions_view.php index 4008b7cd..29629074 100644 --- a/includes/view/Questions_view.php +++ b/includes/view/Questions_view.php @@ -9,22 +9,18 @@ function Questions_view($open_questions, $answered_questions, $ask_action) { foreach ($open_questions as &$question) { - $question['actions'] = '<a href="' - . page_link_to('user_questions', ['action' => 'delete', 'id' => $question['QID']]) - . '">' - . __('delete') - . '</a>'; + $question['actions'] = form([ + form_submit('submit', __('delete'), 'btn-default btn-xs') + ], page_link_to('user_questions', ['action' => 'delete', 'id' => $question['QID']])); $question['Question'] = str_replace("\n", '<br />', $question['Question']); } foreach ($answered_questions as &$question) { $question['Question'] = str_replace("\n", '<br />', $question['Question']); $question['Answer'] = str_replace("\n", '<br />', $question['Answer']); - $question['actions'] = '<a href="' - . page_link_to('user_questions', ['action' => 'delete', 'id' => $question['QID']]) - . '">' - . __('delete') - . '</a>'; + $question['actions'] = form([ + form_submit('submit', __('delete'), 'btn-default btn-xs') + ], page_link_to('user_questions', ['action' => 'delete', 'id' => $question['QID']])); } return page_with_title(questions_title(), [ |