diff options
| author | Greg Aker <greg@gregaker.net> | 2011-08-20 20:58:37 +0200 |
|---|---|---|
| committer | Greg Aker <greg@gregaker.net> | 2011-08-20 20:58:37 +0200 |
| commit | 394d8c5bd3e04bd7992793ca7c648f4306a9539d (patch) | |
| tree | d061b4339f2c3f30428256efae741ab04fd2bf6e /system/helpers/form_helper.php | |
| parent | 43194ea1af658914a89ca49aed4dca4617b9c4ff (diff) | |
| parent | d56be70257696d0bbf2dcc880888d8dc17cba21c (diff) | |
Merge branch 'develop' of github.com:EllisLab/CodeIgniter into develop
Diffstat (limited to 'system/helpers/form_helper.php')
| -rw-r--r-- | system/helpers/form_helper.php | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php index 2925d3c7c..47f93e748 100644 --- a/system/helpers/form_helper.php +++ b/system/helpers/form_helper.php @@ -64,8 +64,8 @@ if ( ! function_exists('form_open')) $form .= '>'; - // CSRF - if ($CI->config->item('csrf_protection') === TRUE) + // Add CSRF field if enabled, but leave it out for GET requests and requests to external websites + if ($CI->config->item('csrf_protection') === TRUE AND ! (strpos($action, $CI->config->site_url()) === FALSE OR strpos($form, 'method="get"'))) { $hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash(); } @@ -249,7 +249,7 @@ if ( ! function_exists('form_textarea')) { function form_textarea($data = '', $value = '', $extra = '') { - $defaults = array('name' => (( ! is_array($data)) ? $data : ''), 'cols' => '90', 'rows' => '12'); + $defaults = array('name' => (( ! is_array($data)) ? $data : ''), 'cols' => '40', 'rows' => '10'); if ( ! is_array($data) OR ! isset($data['value'])) { |