diff options
author | Dylan Hardison <dylan@mozilla.com> | 2015-11-05 06:28:14 +0100 |
---|---|---|
committer | Dylan Hardison <dylan@mozilla.com> | 2015-11-05 06:28:14 +0100 |
commit | 534fc2123e40b7517aeaffd709faf72af97ac3b8 (patch) | |
tree | 18ad69c8fb22e213ee3256c0768e35dd964d2156 /extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl | |
parent | 67d9618771441215d8c431b81bf66acd4faa2aa1 (diff) | |
download | bugzilla-534fc2123e40b7517aeaffd709faf72af97ac3b8.tar.gz bugzilla-534fc2123e40b7517aeaffd709faf72af97ac3b8.tar.xz |
Bug 1196743 - Fix information disclosure vulnerability that allows attacker to obtain victim's GitHub OAuth return code
Diffstat (limited to 'extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl')
-rw-r--r-- | extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl b/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl index 26eb8d63b..609b86159 100644 --- a/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl +++ b/extensions/GitHubAuth/template/en/default/hook/account/auth/login-additional_methods.html.tmpl @@ -5,14 +5,16 @@ # This Source Code Form is "Incompatible With Secondary Licenses", as # defined by the Mozilla Public License, v. 2.0. #%] - +[% USE Bugzilla %] [% IF Param('user_info_class').split(',').contains('GitHubAuth') %] <p> - <a href="[% github_auth.login FILTER html %]"> - <img src="extensions/GitHubAuth/web/images/github_sign_in.png" + <form method="post" action="[% urlbase FILTER html %]github.cgi"> + <input type="hidden" name="github_secret" value="[% Bugzilla.github_secret FILTER html %]"> + <input type="hidden" name="target_uri" value="[% Bugzilla.cgi.target_uri FILTER html %]"> + <input type="image" src="extensions/GitHubAuth/web/images/github_sign_in.png" alt="Sign in with GitHub" title="Sign in with GitHub" width="185" height="25"> - </a> + </form> </p> [% END %] |