summaryrefslogtreecommitdiffstats
path: root/template/en/default/account/auth
diff options
context:
space:
mode:
authorDavid Lawrence <dkl@mozilla.com>2015-04-24 17:56:26 +0200
committerDavid Lawrence <dkl@mozilla.com>2015-04-24 17:56:26 +0200
commit283be21f66e638667bc2ec7720cab459ecf1f698 (patch)
treecdbfbb79d503373bb2058a96f369cf75542dbe3b /template/en/default/account/auth
parented92da4fed393bb0f645f7bad022d49fed336a2f (diff)
downloadbugzilla-283be21f66e638667bc2ec7720cab459ecf1f698.tar.gz
bugzilla-283be21f66e638667bc2ec7720cab459ecf1f698.tar.xz
Bug 1157395: CSRF in log in form
Diffstat (limited to 'template/en/default/account/auth')
-rw-r--r--template/en/default/account/auth/login-small.html.tmpl4
-rw-r--r--template/en/default/account/auth/login.html.tmpl4
2 files changed, 6 insertions, 2 deletions
diff --git a/template/en/default/account/auth/login-small.html.tmpl b/template/en/default/account/auth/login-small.html.tmpl
index 220eb5f21..111aca0dd 100644
--- a/template/en/default/account/auth/login-small.html.tmpl
+++ b/template/en/default/account/auth/login-small.html.tmpl
@@ -72,7 +72,9 @@
[%+ "checked" IF Param('rememberlogin') == "defaulton" %]>
<label for="Bugzilla_remember[% qs_suffix %]">Remember</label>
[% END %]
- <input type="submit" name="GoAheadAndLogIn" value="Log in"
+ <input type="hidden" name="Bugzilla_login_token"
+ value="[% get_login_request_token() FILTER html %]">
+ <input type="submit" name="GoAheadAndLogIn" value="Log in"
id="log_in[% qs_suffix %]">
<a href="#" id="hide_mini_login[% qs_suffix FILTER html %]"
onclick="return hide_mini_login_form('[% qs_suffix %]')">[x]</a>
diff --git a/template/en/default/account/auth/login.html.tmpl b/template/en/default/account/auth/login.html.tmpl
index dac24bcdc..922a55bd4 100644
--- a/template/en/default/account/auth/login.html.tmpl
+++ b/template/en/default/account/auth/login.html.tmpl
@@ -84,8 +84,10 @@
[% PROCESS "global/hidden-fields.html.tmpl"
exclude="^Bugzilla_(login|password|restrictlogin)$" %]
+ <input type="hidden" name="Bugzilla_login_token"
+ value="[% get_login_request_token() FILTER html %]">
<input type="submit" name="GoAheadAndLogIn" value="Log in" id="log_in">
-
+
<p>
(Note: you should make sure cookies are enabled for this site.
Otherwise, you will be required to log in frequently.)