diff options
Diffstat (limited to 'system/helpers')
| -rw-r--r-- | system/helpers/form_helper.php | 4 | ||||
| -rw-r--r-- | system/helpers/html_helper.php | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php index 2925d3c7c..5720a06ec 100644 --- a/system/helpers/form_helper.php +++ b/system/helpers/form_helper.php @@ -64,8 +64,8 @@ if ( ! function_exists('form_open')) $form .= '>'; - // CSRF - if ($CI->config->item('csrf_protection') === TRUE) + // Add CSRF field if enabled, but leave it out for GET requests and requests to external websites + if ($CI->config->item('csrf_protection') === TRUE AND ! (strpos($action, $CI->config->site_url()) === FALSE OR strpos($form, 'method="get"'))) { $hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash(); } diff --git a/system/helpers/html_helper.php b/system/helpers/html_helper.php index 080f622dd..b64b60650 100644 --- a/system/helpers/html_helper.php +++ b/system/helpers/html_helper.php @@ -124,6 +124,10 @@ if ( ! function_exists('_list')) } $attributes = $atts; } + elseif (is_string($attributes) AND strlen($attributes) > 0) + { + $attributes = ' '. $attributes; + } // Write the opening list tag $out .= "<".$type.$attributes.">\n"; |