From 93cc3ebbdc30d2a32de220b2a34fe93d29128bcc Mon Sep 17 00:00:00 2001
From: nbm <nbm@c91229c3-7414-0410-bfa2-8a42b809f60b>
Date: Mon, 12 Dec 2005 19:54:24 +0000
Subject: [PATCH] Ensure that all self-directed forms use POST method and PHP_SELF action.

---
 templates/ktcore/edit_conditional.smarty                     | 6 +++---
 templates/ktcore/edit_fieldset.smarty                        | 6 +++---
 templates/ktcore/edit_lookuptrees.smarty                     | 4 ++--
 templates/ktcore/folder/permissions.smarty                   | 4 ++--
 templates/ktcore/manage_fieldsets.smarty                     | 2 +-
 templates/ktcore/manage_lookuptrees.smarty                   | 4 ++--
 templates/ktcore/manage_permissions.smarty                   | 2 +-
 templates/ktcore/metadata/conditional/editcomplex.smarty     | 2 +-
 templates/ktcore/metadata/conditional/editsimple.smarty      | 2 +-
 templates/ktcore/metadata/conditional/select_fieldset.smarty | 2 +-
 templates/ktcore/metadata/editFieldset.smarty                | 2 +-
 templates/ktcore/principals/groupadmin.smarty                | 2 +-
 templates/ktcore/principals/groups_managesubgroups.smarty    | 2 +-
 templates/ktcore/principals/groups_manageusers.smarty        | 2 +-
 templates/ktcore/principals/orgadmin.smarty                  | 2 +-
 templates/ktcore/principals/roleadmin.smarty                 | 4 ++--
 templates/ktcore/principals/unitadmin.smarty                 | 4 ++--
 templates/ktcore/principals/usergroups.smarty                | 2 +-
 templates/ktcore/search/administration/conditions.smarty     | 4 ++--
 templates/ktcore/search/administration/savedsearches.smarty  | 4 ++--
 templates/ktcore/widget_fieldset_conditional.smarty          | 2 +-
 templates/ktstandard/authentication/ldapeditsource.smarty    | 2 +-
 templates/ktstandard/authentication/ldapedituser.smarty      | 2 +-
 23 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/templates/ktcore/edit_conditional.smarty b/templates/ktcore/edit_conditional.smarty
index 8cb0c4e..23f4a43 100644
--- a/templates/ktcore/edit_conditional.smarty
+++ b/templates/ktcore/edit_conditional.smarty
@@ -1,6 +1,6 @@
 <h2>{i18n}Edit Fieldset{/i18n}</h2>
 
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Current Fields in Set{/i18n}</legend>
 
@@ -28,7 +28,7 @@ to this set.{/i18n}</p>
 <legend>{i18n}Add Field to set{/i18n}</legend>
 <p>{i18n}Fields which are currently not included in any set can be added
 to this set.{/i18n}</p>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="addToFieldset">
 
@@ -52,7 +52,7 @@ to this set.{/i18n}</p>
 <fieldset>
 <legend>{i18n}Make this fieldset conditional{/i18n}</legend>
 
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="makeConditionalSet">
 
diff --git a/templates/ktcore/edit_fieldset.smarty b/templates/ktcore/edit_fieldset.smarty
index 3033d7b..1ec14c1 100644
--- a/templates/ktcore/edit_fieldset.smarty
+++ b/templates/ktcore/edit_fieldset.smarty
@@ -1,6 +1,6 @@
 <h2>{i18n}Edit Fieldset{/i18n}</h2>
 
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Current Fields in Set{/i18n}</legend>
 <p>{i18n}Fields which are currently not included in any set can be added to this set.{/i18n}</p>
@@ -23,7 +23,7 @@
 <fieldset>
 <legend>{i18n}Add Field to set{/i18n}</legend>
 <p>{i18n}Fields which are currently not included in any set can be added to this set.{/i18n}</p>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="addToFieldset">
 
@@ -47,7 +47,7 @@
 <fieldset>
 <legend>{i18n}Make this fieldset conditional{/i18n}</legend>
 
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="makeConditionalSet">
 
diff --git a/templates/ktcore/edit_lookuptrees.smarty b/templates/ktcore/edit_lookuptrees.smarty
index 02cb86b..3d8790e 100644
--- a/templates/ktcore/edit_lookuptrees.smarty
+++ b/templates/ktcore/edit_lookuptrees.smarty
@@ -40,7 +40,7 @@
 <h2>{i18n}Edit Lookup Tree{/i18n}: {$field->getName()}</h2>
 
 
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
   <legend>{i18n}Add New Subcategory{/i18n}</legend>
   
@@ -63,7 +63,7 @@
 <p>{i18n}No free keywords.  Use the "unlink" action on a keyword to 
 make it available.{/i18n}</p>
 {else}
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
   <legend>{i18n}Link free keywords.{/i18n}</legend>
   
diff --git a/templates/ktcore/folder/permissions.smarty b/templates/ktcore/folder/permissions.smarty
index 2362d20..9336b5f 100644
--- a/templates/ktcore/folder/permissions.smarty
+++ b/templates/ktcore/folder/permissions.smarty
@@ -83,7 +83,7 @@ parent's permissions{/i18n}</a>]
 
 { if $edit }
 <div class="edit" id="edit">
-<form method="POST">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="update">
 <input type="hidden" name="fFolderId" value="{$iFolderId}">
 <table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
@@ -159,7 +159,7 @@ $this->assign("aPermissions", $this->_tpl_vars['oDynamicCondition']->getAssignme
 
 { if $edit }
 <h3>{i18n}Add a new dynamic permission{/i18n}</h3>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <table class="pretty" cellpadding="0" cellspacing="0">
 <input type="hidden" name="action" value="newDynamicPermission" />
 <input type="hidden" name="fFolderId" value="{$iFolderId}" />
diff --git a/templates/ktcore/manage_fieldsets.smarty b/templates/ktcore/manage_fieldsets.smarty
index 5f9d727..33463f8 100644
--- a/templates/ktcore/manage_fieldsets.smarty
+++ b/templates/ktcore/manage_fieldsets.smarty
@@ -35,7 +35,7 @@
 
 <h2>{i18n}Create a new Fieldset{/i18n}</h2>
 
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="newFieldset">
 <table>
 <tr>
diff --git a/templates/ktcore/manage_lookuptrees.smarty b/templates/ktcore/manage_lookuptrees.smarty
index a521d27..9d64c15 100644
--- a/templates/ktcore/manage_lookuptrees.smarty
+++ b/templates/ktcore/manage_lookuptrees.smarty
@@ -1,5 +1,5 @@
 <h2>{i18n}Manage Lookup Trees{/i18n}</h1>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Fields that have lookup categories.{/i18n}</legend>
 
@@ -14,7 +14,7 @@
 </form>
 
 <h3>{i18n}Convert to Trees.{/i18n}</h3>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Lookup fields without categories.{/i18n}</legend>
 
diff --git a/templates/ktcore/manage_permissions.smarty b/templates/ktcore/manage_permissions.smarty
index b830a7b..238726b 100644
--- a/templates/ktcore/manage_permissions.smarty
+++ b/templates/ktcore/manage_permissions.smarty
@@ -2,7 +2,7 @@
 
 <p class="descriptiveText"><strong>FIXME</strong> add a useful explanation about permissions.</p>
 
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Create a new permission{/i18n}</legend>
 <input type="hidden" name="action" value="newPermission">
diff --git a/templates/ktcore/metadata/conditional/editcomplex.smarty b/templates/ktcore/metadata/conditional/editcomplex.smarty
index 75a36b8..2709cc5 100644
--- a/templates/ktcore/metadata/conditional/editcomplex.smarty
+++ b/templates/ktcore/metadata/conditional/editcomplex.smarty
@@ -36,7 +36,7 @@ addLoadEvent(updateActiveFields);
 {$context->oPage->requireJSStandalone($sJS)}
 
 <h2>{i18n}Edit Complex Conditional Metadata{/i18n}</h2>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <input type="hidden" name="fieldset_id" id="global-fieldset-id" value="{$fieldset_id}" />
 
 <table>
diff --git a/templates/ktcore/metadata/conditional/editsimple.smarty b/templates/ktcore/metadata/conditional/editsimple.smarty
index 3e6bd5a..d4ba781 100644
--- a/templates/ktcore/metadata/conditional/editsimple.smarty
+++ b/templates/ktcore/metadata/conditional/editsimple.smarty
@@ -61,7 +61,7 @@ addLoadEvent(partial(editSimpleField, {$iMasterFieldId}));
 
 <h2>{i18n}Editing Fieldset Rules (Simple){/i18n}</h2>
 
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <input type="hidden" name="fieldset_id" id="global-fieldset-id" value="{$fieldset_id}" />
 
 <table id="simple_conditional_edit">
diff --git a/templates/ktcore/metadata/conditional/select_fieldset.smarty b/templates/ktcore/metadata/conditional/select_fieldset.smarty
index a1ed64a..2a06a99 100644
--- a/templates/ktcore/metadata/conditional/select_fieldset.smarty
+++ b/templates/ktcore/metadata/conditional/select_fieldset.smarty
@@ -1,6 +1,6 @@
 <h2>{i18n}Select Fieldset{/i18n}</h2>
 
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Current Conditional Fieldsets{/i18n}</legend>
 <p>{i18n}Fieldsets that are marked as conditional.{/i18n}</p>
diff --git a/templates/ktcore/metadata/editFieldset.smarty b/templates/ktcore/metadata/editFieldset.smarty
index 2e40f54..5fb4ebb 100644
--- a/templates/ktcore/metadata/editFieldset.smarty
+++ b/templates/ktcore/metadata/editFieldset.smarty
@@ -69,7 +69,7 @@ field can depend on the user's selections for the others.{/i18n}
 
 {if $oFieldset->getIsConditional() }
 
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="fFieldsetId" value="{$oFieldset->getId()}" />
 <input type="hidden" name="action" value="manageConditional" />
 <input type="submit" name="submit" value="{i18n}Manage conditional{/i18n}" />
diff --git a/templates/ktcore/principals/groupadmin.smarty b/templates/ktcore/principals/groupadmin.smarty
index 6f18e5a..0b51f71 100644
--- a/templates/ktcore/principals/groupadmin.smarty
+++ b/templates/ktcore/principals/groupadmin.smarty
@@ -6,7 +6,7 @@
 <p><a href="?action=addGroup" class="ktAction ktAddGroup" style="float: left; padding-right: 0.5em;">Add Group</a><a href="?action=addGroup">Add a new group</a>.</p>
 
 <!-- we roll both in here. -->
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Search for groups{/i18n}</legend>
 <p class="descriptiveText">{i18n}Since there may be many groups in the
diff --git a/templates/ktcore/principals/groups_managesubgroups.smarty b/templates/ktcore/principals/groups_managesubgroups.smarty
index f588b37..4eb0f10 100644
--- a/templates/ktcore/principals/groups_managesubgroups.smarty
+++ b/templates/ktcore/principals/groups_managesubgroups.smarty
@@ -9,7 +9,7 @@
 <strong>FIXME</strong> there are potential unexpected
 side-effects to this when used by unitAdmins.</p>
 
-<form action="{$smarty.server.PHP_SELF}" method="GET" id="usergroupform">
+<form action="{$smarty.server.PHP_SELF}" method="POST" id="usergroupform">
    <input type="hidden" name="action" value="updateGroupMembers" />
    <input type="hidden" name="group_id" value="{$edit_group->getId()}" />
    <!-- erk. FIXME clean up and remove OptionTransfer.js. -->
diff --git a/templates/ktcore/principals/groups_manageusers.smarty b/templates/ktcore/principals/groups_manageusers.smarty
index c3cc1e3..0da5375 100644
--- a/templates/ktcore/principals/groups_manageusers.smarty
+++ b/templates/ktcore/principals/groups_manageusers.smarty
@@ -7,7 +7,7 @@
 
 <p class="descriptiveText"><strong>FIXME</strong> help text for group-editing.  
 
-<form action="{$smarty.server.PHP_SELF}" method="GET" id="usergroupform">
+<form action="{$smarty.server.PHP_SELF}" method="POST" id="usergroupform">
    <input type="hidden" name="action" value="updateUserMembers" />
    <input type="hidden" name="group_id" value="{$edit_group->getId()}" />
    <!-- erk. FIXME clean up and remove OptionTransfer.js. -->
diff --git a/templates/ktcore/principals/orgadmin.smarty b/templates/ktcore/principals/orgadmin.smarty
index e30f290..bb549f3 100644
--- a/templates/ktcore/principals/orgadmin.smarty
+++ b/templates/ktcore/principals/orgadmin.smarty
@@ -4,7 +4,7 @@
 
 {if ($for_edit === true)}
 
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Change organisation details{/i18n}</legend>
 
diff --git a/templates/ktcore/principals/roleadmin.smarty b/templates/ktcore/principals/roleadmin.smarty
index 990916a..2113043 100644
--- a/templates/ktcore/principals/roleadmin.smarty
+++ b/templates/ktcore/principals/roleadmin.smarty
@@ -7,7 +7,7 @@
 
 {if ($for_edit === false)}
 
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
    <legend>{i18n}Add a Role{/i18n}</legend>
    
@@ -25,7 +25,7 @@
 
 {else}
 
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
    <legend>{i18n}Change a role's details{/i18n}</legend>
    
diff --git a/templates/ktcore/principals/unitadmin.smarty b/templates/ktcore/principals/unitadmin.smarty
index 19ff80f..56debd2 100644
--- a/templates/ktcore/principals/unitadmin.smarty
+++ b/templates/ktcore/principals/unitadmin.smarty
@@ -4,7 +4,7 @@
 
 {if ($for_edit === false)}
 
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Add a unit{/i18n}</legend>
 
@@ -22,7 +22,7 @@
 
 {else}
 
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Change a unit's details{/i18n}</legend>
 
diff --git a/templates/ktcore/principals/usergroups.smarty b/templates/ktcore/principals/usergroups.smarty
index 5d01196..5027eeb 100644
--- a/templates/ktcore/principals/usergroups.smarty
+++ b/templates/ktcore/principals/usergroups.smarty
@@ -9,7 +9,7 @@
 <strong>FIXME</strong> there are potential unexpected
 side-effects to this when used by unitAdmins.</p>
 
-<form action="{$smarty.server.PHP_SELF}" method="GET" id="usergroupform">
+<form action="{$smarty.server.PHP_SELF}" method="POST" id="usergroupform">
    <input type="hidden" name="action" value="updateGroups" />
    <input type="hidden" name="user_id" value="{$edit_user->getId()}" />
    <!-- erk. FIXME clean up and remove OptionTransfer.js. -->
diff --git a/templates/ktcore/search/administration/conditions.smarty b/templates/ktcore/search/administration/conditions.smarty
index 7a2dff1..90c7330 100644
--- a/templates/ktcore/search/administration/conditions.smarty
+++ b/templates/ktcore/search/administration/conditions.smarty
@@ -1,14 +1,14 @@
 <h1>{i18n}Conditions{/i18n}</h1>
 
 <h2>{i18n}Create a new condition{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="new" />
 <input type="submit" name="submit" value="{i18n}New{/i18n}" />
 </form>
 
 {if $conditions}
 <h2>{i18n}Edit existing conditions{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="edit" />
 {entity_radios entities=$conditions name="fSavedSearchId" assign=aRadios}
 {foreach from=$aRadios item=sRadio}
diff --git a/templates/ktcore/search/administration/savedsearches.smarty b/templates/ktcore/search/administration/savedsearches.smarty
index f27acd6..f9cbb4f 100644
--- a/templates/ktcore/search/administration/savedsearches.smarty
+++ b/templates/ktcore/search/administration/savedsearches.smarty
@@ -1,14 +1,14 @@
 <h1>{i18n}Saved searches{/i18n}</h1>
 
 <h2>{i18n}Create a new saved search{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="new" />
 <input type="submit" name="submit" value="{i18n}New{/i18n}" />
 </form>
 
 {if $saved_searches}
 <h2>{i18n}Edit existing saved searches{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="edit" />
 {entity_radios entities=$saved_searches name="fSavedSearchId" assign=aRadios}
 {foreach from=$aRadios item=sRadio}
diff --git a/templates/ktcore/widget_fieldset_conditional.smarty b/templates/ktcore/widget_fieldset_conditional.smarty
index 66c33cb..fedeb41 100644
--- a/templates/ktcore/widget_fieldset_conditional.smarty
+++ b/templates/ktcore/widget_fieldset_conditional.smarty
@@ -121,7 +121,7 @@ function triggerUpdate(formname) {
 {$context->oPage->requireJSStandalone($sJS)}
 
 <!-- do we need to have more than one set of these on a page? -->
-<form >
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <input type="hidden" name="action" value="submitConditionalSet" />
 <input type="hidden" name="fieldset_id" class="resolved_conditional" value="{$fieldset_id}" />
 <!-- add items to handle save here. -->
diff --git a/templates/ktstandard/authentication/ldapeditsource.smarty b/templates/ktstandard/authentication/ldapeditsource.smarty
index 0b834e7..b195007 100644
--- a/templates/ktstandard/authentication/ldapeditsource.smarty
+++ b/templates/ktstandard/authentication/ldapeditsource.smarty
@@ -1,4 +1,4 @@
-<form action="{$smarty.server.PHP_SELF}">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="performEditSourceProvider" />
 <input type="hidden" name="source_id" value="{$source->getId()}" />
 {foreach from=$fields item=oWidget}
diff --git a/templates/ktstandard/authentication/ldapedituser.smarty b/templates/ktstandard/authentication/ldapedituser.smarty
index 91741a4..b6f1ab6 100644
--- a/templates/ktstandard/authentication/ldapedituser.smarty
+++ b/templates/ktstandard/authentication/ldapedituser.smarty
@@ -1,4 +1,4 @@
-<form action="{$smarty.server.PHP_SELF}">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="editUserSource" />
 <input type="hidden" name="user_id" value="{$user->getId()}" />
 {foreach from=$fields item=oWidget}
--
libgit2 0.21.4