From 122ca9bd8b055eaabee2ec54f476749107533565 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 26 Jul 2013 18:16:26 +0300 Subject: Fix #2560 --- system/helpers/form_helper.php | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'system') diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php index bc14df221..7f4276bc7 100644 --- a/system/helpers/form_helper.php +++ b/system/helpers/form_helper.php @@ -54,10 +54,18 @@ if ( ! function_exists('form_open')) { $CI =& get_instance(); - if ($attributes === '') + if (empty($attributes)) { $attributes = 'method="post"'; } + elseif (is_array($attributes) && ! isset($attributes['method'])) + { + $attributes['method'] = 'post'; + } + elseif (stripos($attributes, 'method=') === FALSE) + { + $attributes .= ' method="post"'; + } // If an action is not a full URL then turn it into one if ($action && strpos($action, '://') === FALSE) @@ -73,7 +81,7 @@ if ( ! function_exists('form_open')) $form = '
\n"; // Add CSRF field if enabled, but leave it out for GET requests and requests to external websites - if ($CI->config->item('csrf_protection') === TRUE && ! (strpos($action, $CI->config->base_url()) === FALSE OR strpos($form, 'method="get"'))) + if ($CI->config->item('csrf_protection') === TRUE && ! (strpos($action, $CI->config->base_url()) === FALSE OR stripos($form, 'method="get"'))) { $hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash(); } -- cgit v1.2.3-24-g4f1b