Inspecting $_POST on confirmations may lead to CSRF vulnerabilities: one should use a submit handler. This patch went into 5.x as well.

CommentFileSizeAuthor
#2 confirm_form_doc.patch908 bytesHeine
6_confirm_form.patch620 bytesHeine
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Heine’s picture

Heine CreditAttribution: Heine commented

patch was by barry jaspan btw.

Heine’s picture

Heine CreditAttribution: Heine commented
FileSize
confirm_form_doc.patch908 bytes

Instead of making a mistery of what file changed, a patch with complete headers.

Gábor Hojtsy’s picture

Gábor Hojtsy
he/him
Primary language Hungarian
Location Hungary
CreditAttribution: Gábor Hojtsy commented
Status: Needs review » Fixed

Committed, thanks.

Anonymous’s picture

(not verified) CreditAttribution: commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.