From c4c473b908a62eaf839a61b657397a9c66b1f82c Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Thu, 6 Nov 2008 00:38:49 +0000
Subject: Bug 449931: [SECURITY] Unprivileged users can approve/unapprove all
 the quips (including bypassing moderation) - Patch by Robin H. Johnson
 <robbat2@gentoo.org> r/a=LpSolit

---
 template/en/default/global/user-error.html.tmpl | 2 ++
 template/en/default/list/quips.html.tmpl        | 3 +++
 2 files changed, 5 insertions(+)

(limited to 'template')

diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl
index f4ea42ccf..0936847f5 100644
--- a/template/en/default/global/user-error.html.tmpl
+++ b/template/en/default/global/user-error.html.tmpl
@@ -146,6 +146,8 @@
       schedule
     [% ELSIF action == "use" %]
       use
+    [% ELSIF action == "approve" %]
+      approve
     [% END %]
 
     [% IF object == "administrative_pages" %]
diff --git a/template/en/default/list/quips.html.tmpl b/template/en/default/list/quips.html.tmpl
index b8359ffc6..1404b2e35 100644
--- a/template/en/default/list/quips.html.tmpl
+++ b/template/en/default/list/quips.html.tmpl
@@ -124,6 +124,9 @@
               </a>
             </td>
             <td>
+              <input type="hidden" name="defined_quipid_[% quipid FILTER html %]"
+                     id="defined_quipid_[% quipid FILTER html %]"
+                     value="1">
               <input type="checkbox" name="quipid_[% quipid FILTER html %]"
                      id="quipid_[% quipid FILTER html %]"
                      [%- ' checked="checked"' IF quips.$quipid.approved %]>
-- 
cgit v1.2.3-24-g4f1b