From 944c29b96429ec95ac1371cb33cc43704a60c7b1 Mon Sep 17 00:00:00 2001 From: Igor Scheller Date: Tue, 20 Nov 2018 16:02:03 +0100 Subject: Require POST for sending forms * Ensure that the form is submitted with a post request * Replaced several links with forms Closes #494 (Security Vulnerability) --- includes/view/Questions_view.php | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) (limited to 'includes/view/Questions_view.php') diff --git a/includes/view/Questions_view.php b/includes/view/Questions_view.php index 4008b7cd..29629074 100644 --- a/includes/view/Questions_view.php +++ b/includes/view/Questions_view.php @@ -9,22 +9,18 @@ function Questions_view($open_questions, $answered_questions, $ask_action) { foreach ($open_questions as &$question) { - $question['actions'] = '' - . __('delete') - . ''; + $question['actions'] = form([ + form_submit('submit', __('delete'), 'btn-default btn-xs') + ], page_link_to('user_questions', ['action' => 'delete', 'id' => $question['QID']])); $question['Question'] = str_replace("\n", '
', $question['Question']); } foreach ($answered_questions as &$question) { $question['Question'] = str_replace("\n", '
', $question['Question']); $question['Answer'] = str_replace("\n", '
', $question['Answer']); - $question['actions'] = '' - . __('delete') - . ''; + $question['actions'] = form([ + form_submit('submit', __('delete'), 'btn-default btn-xs') + ], page_link_to('user_questions', ['action' => 'delete', 'id' => $question['QID']])); } return page_with_title(questions_title(), [ -- cgit v1.3.1