diff options
| author | David Lawrence <dkl@mozilla.com> | 2016-10-04 15:16:48 +0200 |
|---|---|---|
| committer | David Lawrence <dkl@mozilla.com> | 2016-10-04 15:16:48 +0200 |
| commit | 125734746e1d48514b2e9affb8dd793d600b7c17 (patch) | |
| tree | 6729dae6c3ed8e55b0b086dc2e8333994fc566da /extensions/Push/template | |
| parent | 3078746b2997a75cc4ec2092f41f2003266cd6fd (diff) | |
| download | bugzilla-125734746e1d48514b2e9affb8dd793d600b7c17.tar.gz bugzilla-125734746e1d48514b2e9affb8dd793d600b7c17.tar.xz | |
Bug 1306589 - BMO: CSRF vulnerability allows deleting admin queue entries
Diffstat (limited to 'extensions/Push/template')
| -rw-r--r-- | extensions/Push/template/en/default/pages/push_queues_view.html.tmpl | 30 |
1 files changed, 19 insertions, 11 deletions
diff --git a/extensions/Push/template/en/default/pages/push_queues_view.html.tmpl b/extensions/Push/template/en/default/pages/push_queues_view.html.tmpl index 6330d8ae4..355e6af91 100644 --- a/extensions/Push/template/en/default/pages/push_queues_view.html.tmpl +++ b/extensions/Push/template/en/default/pages/push_queues_view.html.tmpl @@ -14,6 +14,7 @@ [% IF !message_obj %] <a href="?id=push_queues.html">Return</a> + [% INCLUDE global/footer.html.tmpl %] [% RETURN %] [% END %] @@ -56,6 +57,24 @@ [% END %] <tr> + <th class="report-header">Actions</th> + <td> + <form class="action-button" method="post" action="page.cgi" id="deleteMessage" enctype="multipart/form-data"> + <input type="hidden" name="token" value="[% issue_hash_token(['deleteMessage']) FILTER html %]"> + <input type="hidden" name="id" value="push_queues_view.html"> + <input type="hidden" name="delete" value="1"> + <input type="hidden" name="message" value="[% message_obj.id FILTER html %]"> + <input type="hidden" name="connector" value="[% message_obj.connector FILTER html %]"> + <input type="submit" value="Delete"> + </form> + <form class="action-button" method="post" action="page.cgi" id="returnQueue" enctype="multipart/form-data"> + <input type="hidden" name="id" value="push_queues.html"> + <input type="submit" value="Return"> + </form> + </td> +</tr> + +<tr> <td colspan="2"> [% IF json %] <pre>[% json FILTER html %]</pre> @@ -64,17 +83,6 @@ [% END %] </td> </tr> - -<tr class="report-header"> - <th colspan="2"> - <a href="?id=push_queues.html">Return</a> | - <a onclick="return confirm('Are you sure you want to delete this message forever (a long time)?')" - href="?id=push_queues_view.html&delete=1 - [%- %]&message=[% message_obj.id FILTER uri %] - [%- %]&connector=[% message_obj.connector FILTER uri %]">Delete</a> - </th> -</tr> - </table> [% INCLUDE global/footer.html.tmpl %] |