3006cb544f
The way this now works is, if csrf is enabled: * Any new or existing template can have csrf protection by adding the hidden input ctoken that's in this batch to its form, removes any logic in templates * Page controllers that already exist have been updated, new ones only require checking if csrf is enabled and valid
12 lines
743 B
Smarty
12 lines
743 B
Smarty
<form action="{$smarty.server.SCRIPT_NAME}" method="post">
|
|
<input type="hidden" name="token" value="{$smarty.request.token|escape}">
|
|
<input type="hidden" name="page" value="{$smarty.request.page|escape}">
|
|
<input type="hidden" name="action" value="{$smarty.request.action|escape}">
|
|
<input type="hidden" name="ctoken" value="{$CTOKEN|escape|default:""}" />
|
|
<input type="hidden" name="do" value="useToken">
|
|
<table>
|
|
<tr><td>New Password: </td><td><input type="password" name="newPassword"></td></tr>
|
|
<tr><td>New Password Repeat: </td><td><input type="password" name="newPassword2"></td></tr>
|
|
</tbody></table>
|
|
<input type="submit" class="submit long" value="Change Password"></form>
|