diff options
| author | Dylan Hardison <dylan@mozilla.com> | 2016-03-01 14:14:26 +0100 |
|---|---|---|
| committer | Dylan Hardison <dylan@mozilla.com> | 2016-03-01 14:22:04 +0100 |
| commit | 085c24c80c6a79f21aba768bf16955685dcc47b7 (patch) | |
| tree | 5c23f767a81b5fcd64adb89d4f74d5e320a053ef /extensions/EditTable/template | |
| parent | e5b9aa6ef469adb5db2ff4b7575342bd79fd450a (diff) | |
| download | bugzilla-085c24c80c6a79f21aba768bf16955685dcc47b7.tar.gz bugzilla-085c24c80c6a79f21aba768bf16955685dcc47b7.tar.xz | |
Bug 1252210 - AntiSpam configuration is vulnerable to CSRF and persistent XSS
Diffstat (limited to 'extensions/EditTable/template')
| -rw-r--r-- | extensions/EditTable/template/en/default/pages/edit_table.html.tmpl | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl b/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl index d81291640..98a8f4184 100644 --- a/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl +++ b/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl @@ -30,12 +30,14 @@ onsubmit="editTable.to_json('table_data')"> <input type="hidden" name="id" value="edit_table.html"> <input type="hidden" name="table" value="[% table_name FILTER html %]"> +<input type="hidden" name="token" value="[% token FILTER html %]"> <input type="hidden" name="table_data" id="table_data"> <input type="submit" value="Commit Changes" id="commit_btn" class="bz_default_hidden"> </form> <script> - var table_data = [% table_data FILTER none %]; + var table_data_str = "[% table_data FILTER js %]"; + var table_data = $.parseJSON(table_data_str); var editTable = new EditTable('edit_table', table_data); editTable.render(); </script> |