Ensure that all self-directed forms use POST method and PHP_SELF action.

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@4423 c91229c3-7414-0410-bfa2-8a42b809f60b

Ensure that all self-directed forms use POST method and PHP_SELF action.
git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@4423 c91229c3-7414-0410-bfa2-8a42b809f60b
nbm
1 parent bb4a5e85
Showing 23 changed files with 34 additions and 34 deletions
templates/ktcore/edit_conditional.smarty
templates/ktcore/edit_fieldset.smarty
templates/ktcore/edit_lookuptrees.smarty
templates/ktcore/folder/permissions.smarty
templates/ktcore/manage_fieldsets.smarty
templates/ktcore/manage_lookuptrees.smarty
templates/ktcore/manage_permissions.smarty
templates/ktcore/metadata/conditional/editcomplex.smarty
templates/ktcore/metadata/conditional/editsimple.smarty
templates/ktcore/metadata/conditional/select_fieldset.smarty
templates/ktcore/metadata/editFieldset.smarty
templates/ktcore/principals/groupadmin.smarty
templates/ktcore/principals/groups_managesubgroups.smarty
templates/ktcore/principals/groups_manageusers.smarty
templates/ktcore/principals/orgadmin.smarty
templates/ktcore/principals/roleadmin.smarty
templates/ktcore/principals/unitadmin.smarty
templates/ktcore/principals/usergroups.smarty
templates/ktcore/search/administration/conditions.smarty
templates/ktcore/search/administration/savedsearches.smarty
 <h2>{i18n}Edit Fieldset{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Current Fields in Set{/i18n}</legend>
@@ -28,7 +28,7 @@ to this set.{/i18n}&lt;/p&gt;
 <legend>{i18n}Add Field to set{/i18n}</legend>
 <p>{i18n}Fields which are currently not included in any set can be added
 to this set.{/i18n}</p>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="addToFieldset">
@@ -52,7 +52,7 @@ to this set.{/i18n}&lt;/p&gt;
 <fieldset>
 <legend>{i18n}Make this fieldset conditional{/i18n}</legend>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="makeConditionalSet">
 <h2>{i18n}Edit Fieldset{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Current Fields in Set{/i18n}</legend>
 <p>{i18n}Fields which are currently not included in any set can be added to this set.{/i18n}</p>
@@ -23,7 +23,7 @@
 <fieldset>
 <legend>{i18n}Add Field to set{/i18n}</legend>
 <p>{i18n}Fields which are currently not included in any set can be added to this set.{/i18n}</p>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="addToFieldset">
@@ -47,7 +47,7 @@
 <fieldset>
 <legend>{i18n}Make this fieldset conditional{/i18n}</legend>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="id" value="{$setId}" />
 <input type="hidden" name="action" value="makeConditionalSet">
@@ -40,7 +40,7 @@
 <h2>{i18n}Edit Lookup Tree{/i18n}: {$field->getName()}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
   <legend>{i18n}Add New Subcategory{/i18n}</legend>
@@ -63,7 +63,7 @@
 <p>{i18n}No free keywords.  Use the "unlink" action on a keyword to 
 make it available.{/i18n}</p>
 {else}
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
   <legend>{i18n}Link free keywords.{/i18n}</legend>
@@ -83,7 +83,7 @@ parent&#39;s permissions{/i18n}&lt;/a&gt;]
 { if $edit }
 <div class="edit" id="edit">
-<form method="POST">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="update">
 <input type="hidden" name="fFolderId" value="{$iFolderId}">
 <table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
@@ -159,7 +159,7 @@ $this-&gt;assign(&quot;aPermissions&quot;, $this-&gt;_tpl_vars[&#39;oDynamicCondition&#39;]-&gt;getAssignme
 { if $edit }
 <h3>{i18n}Add a new dynamic permission{/i18n}</h3>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <table class="pretty" cellpadding="0" cellspacing="0">
 <input type="hidden" name="action" value="newDynamicPermission" />
 <input type="hidden" name="fFolderId" value="{$iFolderId}" />
@@ -35,7 +35,7 @@
 <h2>{i18n}Create a new Fieldset{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="newFieldset">
 <table>
 <tr>
 <h2>{i18n}Manage Lookup Trees{/i18n}</h1>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Fields that have lookup categories.{/i18n}</legend>
@@ -14,7 +14,7 @@
 </form>
 <h3>{i18n}Convert to Trees.{/i18n}</h3>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Lookup fields without categories.{/i18n}</legend>
@@ -2,7 +2,7 @@
 <p class="descriptiveText"><strong>FIXME</strong> add a useful explanation about permissions.</p>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Create a new permission{/i18n}</legend>
 <input type="hidden" name="action" value="newPermission">
@@ -36,7 +36,7 @@ addLoadEvent(updateActiveFields);
 {$context->oPage->requireJSStandalone($sJS)}
 <h2>{i18n}Edit Complex Conditional Metadata{/i18n}</h2>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <input type="hidden" name="fieldset_id" id="global-fieldset-id" value="{$fieldset_id}" />
 <table>
@@ -61,7 +61,7 @@ addLoadEvent(partial(editSimpleField, {$iMasterFieldId}));
 <h2>{i18n}Editing Fieldset Rules (Simple){/i18n}</h2>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <input type="hidden" name="fieldset_id" id="global-fieldset-id" value="{$fieldset_id}" />
 <table id="simple_conditional_edit">
 <h2>{i18n}Select Fieldset{/i18n}</h2>
-<form>
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <fieldset>
 <legend>{i18n}Current Conditional Fieldsets{/i18n}</legend>
 <p>{i18n}Fieldsets that are marked as conditional.{/i18n}</p>
@@ -69,7 +69,7 @@ field can depend on the user&#39;s selections for the others.{/i18n}
 {if $oFieldset->getIsConditional() }
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="fFieldsetId" value="{$oFieldset->getId()}" />
 <input type="hidden" name="action" value="manageConditional" />
 <input type="submit" name="submit" value="{i18n}Manage conditional{/i18n}" />
@@ -6,7 +6,7 @@
 <p><a href="?action=addGroup" class="ktAction ktAddGroup" style="float: left; padding-right: 0.5em;">Add Group</a><a href="?action=addGroup">Add a new group</a>.</p>
 <!-- we roll both in here. -->
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Search for groups{/i18n}</legend>
 <p class="descriptiveText">{i18n}Since there may be many groups in the
@@ -9,7 +9,7 @@
 <strong>FIXME</strong> there are potential unexpected
 side-effects to this when used by unitAdmins.</p>
-<form action="{$smarty.server.PHP_SELF}" method="GET" id="usergroupform">
+<form action="{$smarty.server.PHP_SELF}" method="POST" id="usergroupform">
    <input type="hidden" name="action" value="updateGroupMembers" />
    <input type="hidden" name="group_id" value="{$edit_group->getId()}" />
    <!-- erk. FIXME clean up and remove OptionTransfer.js. -->
@@ -7,7 +7,7 @@
 <p class="descriptiveText"><strong>FIXME</strong> help text for group-editing.  
-<form action="{$smarty.server.PHP_SELF}" method="GET" id="usergroupform">
+<form action="{$smarty.server.PHP_SELF}" method="POST" id="usergroupform">
    <input type="hidden" name="action" value="updateUserMembers" />
    <input type="hidden" name="group_id" value="{$edit_group->getId()}" />
    <!-- erk. FIXME clean up and remove OptionTransfer.js. -->
@@ -4,7 +4,7 @@
 {if ($for_edit === true)}
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Change organisation details{/i18n}</legend>
@@ -7,7 +7,7 @@
 {if ($for_edit === false)}
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
    <legend>{i18n}Add a Role{/i18n}</legend>
@@ -25,7 +25,7 @@
 {else}
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
    <legend>{i18n}Change a role's details{/i18n}</legend>
@@ -4,7 +4,7 @@
 {if ($for_edit === false)}
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Add a unit{/i18n}</legend>
@@ -22,7 +22,7 @@
 {else}
-<form action="{$smarty.server.PHP_SELF}" method="GET">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
 <legend>{i18n}Change a unit's details{/i18n}</legend>
@@ -9,7 +9,7 @@
 <strong>FIXME</strong> there are potential unexpected
 side-effects to this when used by unitAdmins.</p>
-<form action="{$smarty.server.PHP_SELF}" method="GET" id="usergroupform">
+<form action="{$smarty.server.PHP_SELF}" method="POST" id="usergroupform">
    <input type="hidden" name="action" value="updateGroups" />
    <input type="hidden" name="user_id" value="{$edit_user->getId()}" />
    <!-- erk. FIXME clean up and remove OptionTransfer.js. -->
 <h1>{i18n}Conditions{/i18n}</h1>
 <h2>{i18n}Create a new condition{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="new" />
 <input type="submit" name="submit" value="{i18n}New{/i18n}" />
 </form>
 {if $conditions}
 <h2>{i18n}Edit existing conditions{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="edit" />
 {entity_radios entities=$conditions name="fSavedSearchId" assign=aRadios}
 {foreach from=$aRadios item=sRadio}
 <h1>{i18n}Saved searches{/i18n}</h1>
 <h2>{i18n}Create a new saved search{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="new" />
 <input type="submit" name="submit" value="{i18n}New{/i18n}" />
 </form>
 {if $saved_searches}
 <h2>{i18n}Edit existing saved searches{/i18n}</h2>
-<form>
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="edit" />
 {entity_radios entities=$saved_searches name="fSavedSearchId" assign=aRadios}
 {foreach from=$aRadios item=sRadio}
@@ -121,7 +121,7 @@ function triggerUpdate(formname) {
 {$context->oPage->requireJSStandalone($sJS)}
 <!-- do we need to have more than one set of these on a page? -->
-<form >
+<form method="POST" action="{$smarty.server.PHP_SELF}">
 <input type="hidden" name="action" value="submitConditionalSet" />
 <input type="hidden" name="fieldset_id" class="resolved_conditional" value="{$fieldset_id}" />
 <!-- add items to handle save here. -->
-<form action="{$smarty.server.PHP_SELF}">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="performEditSourceProvider" />
 <input type="hidden" name="source_id" value="{$source->getId()}" />
 {foreach from=$fields item=oWidget}
-<form action="{$smarty.server.PHP_SELF}">
+<form action="{$smarty.server.PHP_SELF}" method="POST">
 <input type="hidden" name="action" value="editUserSource" />
 <input type="hidden" name="user_id" value="{$user->getId()}" />
 {foreach from=$fields item=oWidget}