summaryrefslogtreecommitdiffstats
path: root/extensions/EditTable/template/en
diff options
context:
space:
mode:
authorDylan Hardison <dylan@mozilla.com>2016-03-01 14:14:26 +0100
committerDylan Hardison <dylan@mozilla.com>2016-03-01 14:22:04 +0100
commit085c24c80c6a79f21aba768bf16955685dcc47b7 (patch)
tree5c23f767a81b5fcd64adb89d4f74d5e320a053ef /extensions/EditTable/template/en
parente5b9aa6ef469adb5db2ff4b7575342bd79fd450a (diff)
downloadbugzilla-085c24c80c6a79f21aba768bf16955685dcc47b7.tar.gz
bugzilla-085c24c80c6a79f21aba768bf16955685dcc47b7.tar.xz
Bug 1252210 - AntiSpam configuration is vulnerable to CSRF and persistent XSS
Diffstat (limited to 'extensions/EditTable/template/en')
-rw-r--r--extensions/EditTable/template/en/default/pages/edit_table.html.tmpl4
1 files changed, 3 insertions, 1 deletions
diff --git a/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl b/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl
index d81291640..98a8f4184 100644
--- a/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl
+++ b/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl
@@ -30,12 +30,14 @@
onsubmit="editTable.to_json('table_data')">
<input type="hidden" name="id" value="edit_table.html">
<input type="hidden" name="table" value="[% table_name FILTER html %]">
+<input type="hidden" name="token" value="[% token FILTER html %]">
<input type="hidden" name="table_data" id="table_data">
<input type="submit" value="Commit Changes" id="commit_btn" class="bz_default_hidden">
</form>
<script>
- var table_data = [% table_data FILTER none %];
+ var table_data_str = "[% table_data FILTER js %]";
+ var table_data = $.parseJSON(table_data_str);
var editTable = new EditTable('edit_table', table_data);
editTable.render();
</script>