diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-08-13 17:49:31 +0200 |
|---|---|---|
| committer | Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-08-13 17:49:31 +0200 |
| commit | e6fd34bdda5d067a9e74714aaae10c89ed998a46 (patch) | |
| tree | 1a82e54e636f856983e8cd94ec00247eb9987b27 /app/views/configure/sharing.phtml | |
| parent | 97efdcac1e38c568b6be313120694e7201d4c69c (diff) | |
CSRF token, update HTTP Referrer policy to same-origin
https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
Diffstat (limited to 'app/views/configure/sharing.phtml')
| -rw-r--r-- | app/views/configure/sharing.phtml | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/app/views/configure/sharing.phtml b/app/views/configure/sharing.phtml index 7bf435777..0dad5bf6d 100644 --- a/app/views/configure/sharing.phtml +++ b/app/views/configure/sharing.phtml @@ -15,6 +15,7 @@ <a href="#" class="remove btn btn-attention" data-remove="group-share-##key##"><?php echo _i('close'); ?></a></div> <a target="_blank" class="btn" title="<?php echo _t('conf.sharing.more_information'); ?>" href="##help##"><?php echo _i('help'); ?></a> </div></div>'> + <input type="hidden" name="_csrf" value="<?php echo FreshRSS_Auth::csrfToken(); ?>" /> <legend><?php echo _t('conf.sharing'); ?></legend> <?php foreach (FreshRSS_Context::$user_conf->sharing as $key => $share_options) { |