diff options
| -rwxr-xr-x | chart.cgi | 8 | ||||
| -rw-r--r-- | template/en/default/reports/edit-series.html.tmpl | 2 | ||||
| -rw-r--r-- | template/en/default/search/search-create-series.html.tmpl | 1 |
3 files changed, 9 insertions, 2 deletions
@@ -146,6 +146,8 @@ elsif ($action eq "wrap") { } elsif ($action eq "create") { assertCanCreate($cgi); + my $token = $cgi->param('token'); + check_hash_token($token, ['create-series']); my $series = new Bugzilla::Series($cgi); @@ -164,9 +166,11 @@ elsif ($action eq "edit") { edit($series); } elsif ($action eq "alter") { - assertCanEdit($series_id); + my $series = assertCanEdit($series_id); + my $token = $cgi->param('token'); + check_hash_token($token, [$series->id, $series->name]); # XXX - This should be replaced by $series->set_foo() methods. - my $series = new Bugzilla::Series($cgi); + $series = new Bugzilla::Series($cgi); # We need to check if there is _another_ series in the database with # our (potentially new) name. So we call existsInDatabase() to see if diff --git a/template/en/default/reports/edit-series.html.tmpl b/template/en/default/reports/edit-series.html.tmpl index 9afe7edcd..da7d15e0a 100644 --- a/template/en/default/reports/edit-series.html.tmpl +++ b/template/en/default/reports/edit-series.html.tmpl @@ -40,6 +40,8 @@ [% PROCESS reports/series.html.tmpl button_name = "Change Data Set" %] <input type="hidden" name="action" value="alter"> + <input type="hidden" name="token" + value="[% issue_hash_token([default.id, default.name]) FILTER html %]"> [% IF default.series_id %] <input type="hidden" name="series_id" value="[% default.series_id %]"> diff --git a/template/en/default/search/search-create-series.html.tmpl b/template/en/default/search/search-create-series.html.tmpl index 2aa5224c4..468324abd 100644 --- a/template/en/default/search/search-create-series.html.tmpl +++ b/template/en/default/search/search-create-series.html.tmpl @@ -54,6 +54,7 @@ [% PROCESS reports/series.html.tmpl button_name = "Create Data Set" %] <input type="hidden" name="action" value="create"> + <input type="hidden" name="token" value="[% issue_hash_token(['create-series']) FILTER html %]"> <script type="text/javascript"> document.chartform.category[0].selected = true; |