engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

forms: unified usage of h.secure_form. Make sure we ALWAYS pass in

Browse source 
request, and removed redundant 'POST' type.
This commit is contained in:
Marcin Kuzminski 2017-09-20 16:43:08 +02:00
parent 26635ebc3e
commit 3839c4720e
55 changed files with 71 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

2
rhodecode/templates/admin/defaults/defaults_repositories.mako
View file

@ -3,7 +3,7 @@
<h3 class="panel-title">${_('Default Settings For New Repositories')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('admin_defaults_repositories_update'), method='POST', request=request)}
${h.secure_form(h.route_path('admin_defaults_repositories_update'), request=request)}
<div class="form">
<!-- fields -->

2
rhodecode/templates/admin/gists/edit.mako
View file

@ -26,7 +26,7 @@
<div class="table">
<div id="files_data">
${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST', request=request)}
${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', request=request)}
<div>
<input type="hidden" value="${c.file_last_commit.raw_id}" name="parent_hash">
<textarea id="description" name="description"

2
rhodecode/templates/admin/gists/new.mako
View file

@ -25,7 +25,7 @@
<div class="table">
<div id="files_data">
${h.secure_form(h.route_path('gists_create'), id='eform', method='POST', request=request)}
${h.secure_form(h.route_path('gists_create'), id='eform', request=request)}
<div>
<textarea id="description" name="description" placeholder="${_('Gist description ...')}"></textarea>

2
rhodecode/templates/admin/gists/show.mako
View file

@ -45,7 +45,7 @@
<div class="stats">
%if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
<div class="remove_gist">
${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST', request=request)}
${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), request=request)}
${h.submit('remove_gist', _('Delete'),class_="btn btn-mini btn-danger",onclick="return confirm('"+_('Confirm to delete this Gist')+"');")}
${h.end_form()}
</div>

4
rhodecode/templates/admin/my_account/my_account_auth_tokens.mako
View file

@ -42,7 +42,7 @@
%endif
</td>
<td class="td-action">
${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='POST', request=request)}
${h.secure_form(h.route_path('my_account_auth_tokens_delete'), request=request)}
${h.hidden('del_auth_token', auth_token.user_api_key_id)}
<button class="btn btn-link btn-danger" type="submit"
onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
@ -59,7 +59,7 @@
</div>
<div class="user_auth_tokens">
${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='POST', request=request)}
${h.secure_form(h.route_path('my_account_auth_tokens_add'), request=request)}
<div class="form form-vertical">
<!-- fields -->
<div class="fields">

4
rhodecode/templates/admin/my_account/my_account_emails.mako
View file

@ -25,7 +25,7 @@
<span class="user email">${em.email}</span>
</td>
<td class="td-action">
${h.secure_form(h.route_path('my_account_emails_delete'), method='POST', request=request)}
${h.secure_form(h.route_path('my_account_emails_delete'), request=request)}
${h.hidden('del_email_id',em.email_id)}
<button class="btn btn-link btn-danger" type="submit" id="${'remove_email_%s'.format(em.email_id)}"
onclick="return confirm('${_('Confirm to delete this email: {}').format(em.email)}');">
@ -48,7 +48,7 @@
</div>
<div>
${h.secure_form(h.route_path('my_account_emails_add'), method='POST', request=request)}
${h.secure_form(h.route_path('my_account_emails_add'), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/my_account/my_account_profile_edit.mako
View file

@ -6,7 +6,7 @@
</div>
<div class="panel-body">
${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST', request=request)}
${h.secure_form(h.route_path('my_account_update'), class_='form', request=request)}
<% readonly = None %>
<% disabled = "" %>

4
rhodecode/templates/admin/my_account/my_account_ssh_keys.mako
View file

@ -24,7 +24,7 @@
<td class="td-tags">${h.format_date(ssh_key.created_on)}</td>
<td class="td-action">
${h.secure_form(h.route_path('my_account_ssh_keys_delete'), method='POST', request=request)}
${h.secure_form(h.route_path('my_account_ssh_keys_delete'), request=request)}
${h.hidden('del_ssh_key', ssh_key.ssh_key_id)}
<button class="btn btn-link btn-danger" type="submit"
onclick="return confirm('${_('Confirm to remove ssh key %s') % ssh_key.ssh_key_fingerprint}');">
@ -43,7 +43,7 @@
% if c.ssh_enabled:
<div class="user_ssh_keys">
${h.secure_form(h.route_path('my_account_ssh_keys_add'), method='POST', request=request)}
${h.secure_form(h.route_path('my_account_ssh_keys_add'), request=request)}
<div class="form form-vertical">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/permissions/permissions_application.mako
View file

@ -3,7 +3,7 @@
<h3 class="panel-title">${_('System Wide Application Permissions')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('admin_permissions_application_update'), method='POST', request=request)}
${h.secure_form(h.route_path('admin_permissions_application_update'), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/permissions/permissions_global.mako
View file

@ -1,5 +1,5 @@
${h.secure_form(h.route_path('admin_permissions_global_update'), method='POST', request=request)}
${h.secure_form(h.route_path('admin_permissions_global_update'), request=request)}
<div class="form permissions-global">
<!-- fields -->
<div class="fields">

4
rhodecode/templates/admin/permissions/permissions_ips.mako
View file

@ -23,7 +23,7 @@
<td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
<td class="td-description"><div class="ip">${ip.description}</div></td>
<td class="td-action">
${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), request=request)}
${h.hidden('del_ip_id',ip.ip_id)}
${h.hidden('default_user', 'True')}
${h.submit('remove_',_('Delete'),id="remove_ip_%s" % ip.ip_id,
@ -43,7 +43,7 @@
</table>
</div>
${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/permissions/permissions_objects.mako
View file

@ -5,7 +5,7 @@
<div class="panel-body">
<p>${_('Default system permissions. Each permissions management entity will be created with the following default settings. Check the overwrite checkbox to force any permission changes on already existing settings.')}
</p>
${h.secure_form(h.route_path('admin_permissions_object_update'), method='POST', request=request)}
${h.secure_form(h.route_path('admin_permissions_object_update'), request=request)}
<div class="form">
<div class="fields">
<div class="field">

2
rhodecode/templates/admin/permissions/permissions_ssh_keys.mako
View file

@ -3,7 +3,7 @@
<div class="panel-heading">
<h3 class="panel-title">${_('SSH Keys')} - <span id="ssh_keys_count"></span></h3>
${h.secure_form(h.route_path('admin_permissions_ssh_keys_update'), method='POST', request=request)}
${h.secure_form(h.route_path('admin_permissions_ssh_keys_update'), request=request)}
<button class="btn btn-link pull-right" type="submit">${_('Update SSH keys file')}</button>
${h.end_form()}
</div>

2
rhodecode/templates/admin/repo_groups/repo_group_add.mako
View file

@ -27,7 +27,7 @@
${self.breadcrumbs()}
</div>
<!-- end box / title -->
${h.secure_form(h.url('repo_groups'), method='post')}
${h.secure_form(h.url('repo_groups'), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/repo_groups/repo_group_edit_advanced.mako
View file

@ -28,7 +28,7 @@
<h3 class="panel-title">${_('Delete repository group')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.url('delete_repo_group', group_name=c.repo_group.group_name),method='delete')}
${h.secure_form(h.url('delete_repo_group', group_name=c.repo_group.group_name),method='delete', request=request)}
<table class="display">
<tr>

2
rhodecode/templates/admin/repo_groups/repo_group_edit_perms.mako
View file

@ -5,7 +5,7 @@
<h3 class="panel-title">${_('Repository Group Permissions')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put')}
${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put', request=request)}
<table id="permissions_manage" class="rctable permissions">
<tr>
<th class="td-radio">${_('None')}</th>

2
rhodecode/templates/admin/repo_groups/repo_group_edit_settings.mako
View file

@ -6,7 +6,7 @@
<h3 class="panel-title">${_('Settings for Repository Group: %s') % c.repo_group.name}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.url('update_repo_group',group_name=c.repo_group.group_name),method='put')}
${h.secure_form(h.url('update_repo_group',group_name=c.repo_group.group_name),method='put', request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/repos/repo_add_base.mako
View file

@ -1,6 +1,6 @@
## -*- coding: utf-8 -*-
${h.secure_form(h.route_path('repo_create'), method='POST', request=request)}
${h.secure_form(h.route_path('repo_create'), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

8
rhodecode/templates/admin/repos/repo_edit_advanced.mako
View file

@ -24,7 +24,7 @@
<h3 class="panel-title">${_('Fork Reference')} <a class="permalink" href="#advanced-fork"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
% if c.rhodecode_db_repo.fork:
<div class="panel-body-title-text">${h.literal(_('This repository is a fork of %(repo_link)s') % {'repo_link': h.link_to_if(c.has_origin_repo_read_perm,c.rhodecode_db_repo.fork.repo_name, h.route_path('repo_summary', repo_name=c.rhodecode_db_repo.fork.repo_name))})}
@ -48,7 +48,7 @@
<h3 class="panel-title">${_('Public Journal Visibility')} <a class="permalink" href="#advanced-journal"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
<div class="field">
%if c.in_public_journal:
<button class="btn btn-small" type="submit">
@ -73,7 +73,7 @@
<h3 class="panel-title">${_('Locking state')} <a class="permalink" href="#advanced-locking"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
%if c.rhodecode_db_repo.locked[0]:
<div class="panel-body-title-text">${'Locked by %s on %s. Lock reason: %s' % (h.person_by_id(c.rhodecode_db_repo.locked[0]),
@ -113,7 +113,7 @@
<h3 class="panel-title">${_('Delete repository')} <a class="permalink" href="#advanced-delete"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), request=request)}
<table class="display">
<tr>
<td>

2
rhodecode/templates/admin/repos/repo_edit_caches.mako
View file

@ -14,7 +14,7 @@
</code>
</p>
${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), request=request)}
<div class="form">
<div class="fields">
${h.submit('reset_cache_%s' % c.rhodecode_db_repo.repo_name,_('Invalidate repository cache'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to invalidate repository cache')+"');")}

4
rhodecode/templates/admin/repos/repo_edit_fields.mako
View file

@ -18,7 +18,7 @@
<td class="td-hash">${field.field_key}</td>
<td class="td-type">${field.field_type}</td>
<td class="td-action">
${h.secure_form(h.route_path('edit_repo_fields_delete', repo_name=c.rhodecode_db_repo.repo_name, field_id=field.repo_field_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_fields_delete', repo_name=c.rhodecode_db_repo.repo_name, field_id=field.repo_field_id), request=request)}
${h.hidden('del_repo_field',field.repo_field_id)}
<button class="btn btn-link btn-danger" type="submit"
onclick="return confirm('${_('Confirm to delete this field: %s') % field.field_key}');">
@ -31,7 +31,7 @@
</table>
</div>
%endif
${h.secure_form(h.route_path('edit_repo_fields_create', repo_name=c.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_fields_create', repo_name=c.repo_name), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/repos/repo_edit_issuetracker.mako
View file

@ -1,7 +1,7 @@
<%namespace name="its" file="/base/issue_tracker_settings.mako"/>
<div id="repo_issue_tracker" class="${'inherited' if c.settings_model.inherit_global_settings else ''}">
${h.secure_form(h.route_path('edit_repo_issuetracker_update', repo_name=c.repo_name), id="inherit-form", method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_issuetracker_update', repo_name=c.repo_name), id="inherit-form", request=request)}
<div class="panel panel-default panel-body">
<div class="fields">
<div class="field">

2
rhodecode/templates/admin/repos/repo_edit_permissions.mako
View file

@ -5,7 +5,7 @@
<h3 class="panel-title">${_('Repository Permissions')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), request=request)}
<table id="permissions_manage" class="rctable permissions">
<tr>
<th class="td-radio">${_('None')}</th>

2
rhodecode/templates/admin/repos/repo_edit_remote.mako
View file

@ -19,7 +19,7 @@
</code>
</p>
${h.secure_form(h.route_path('edit_repo_remote_pull', repo_name=c.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_remote_pull', repo_name=c.repo_name), request=request)}
<div class="form">
<div class="fields">
${h.submit('remote_pull_%s' % c.rhodecode_db_repo.repo_name,_('Pull changes from remote location'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to pull changes from remote side')+"');")}

2
rhodecode/templates/admin/repos/repo_edit_settings.mako
View file

@ -6,7 +6,7 @@
<h3 class="panel-title">${_('Settings for Repository: %s') % c.rhodecode_db_repo.repo_name}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/repos/repo_edit_statistics.mako
View file

@ -3,7 +3,7 @@
<h3 class="panel-title">${_('Repository statistics')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_statistics_reset', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_statistics_reset', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
<div class="form">
<div class="fields">
<div class="field" >

2
rhodecode/templates/admin/repos/repo_edit_strip.mako
View file

@ -9,7 +9,7 @@
${_('In the first step commits will be verified for existance in the repository')}. </br>
${_('In the second step, correct commits will be available for stripping')}.
</p>
${h.secure_form(h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
<div id="change_body" class="field">
<div id="box-1" class="inputx locked_input">
<input class="text" id="changeset_id-1" name="changeset_id-1" size="59"

2
rhodecode/templates/admin/repos/repo_edit_vcs.mako
View file

@ -1,7 +1,7 @@
<%namespace name="vcss" file="/base/vcs_settings.mako"/>
<div id="repo_vcs_settings" class="${'inherited' if c.inherit_global_settings else ''}">
${h.secure_form(h.route_path('edit_repo_vcs_update', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_vcs_update', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
<div class="form panel panel-default">
<div class="fields panel-body">
<div class="field">

2
rhodecode/templates/admin/settings/settings_email.mako
View file

@ -34,7 +34,7 @@
<h3 class="panel-title">${_('Test Email')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.url('admin_settings_email'), method='post')}
${h.secure_form(h.url('admin_settings_email'), request=request)}
<div class="field input">
${h.text('test_email', size=60, placeholder=_('enter valid email'))}

2
rhodecode/templates/admin/settings/settings_global.mako
View file

@ -1,4 +1,4 @@
${h.secure_form(h.url('admin_settings_global'), method='post')}
${h.secure_form(h.url('admin_settings_global'), request=request)}
<div class="panel panel-default">
<div class="panel-heading" id="branding-options">

2
rhodecode/templates/admin/settings/settings_hooks.mako
View file

@ -28,7 +28,7 @@
</div>
<div class="panel-body">
% if c.visual.allow_custom_hooks_settings:
${h.secure_form(h.url('admin_settings_hooks'), method='post')}
${h.secure_form(h.url('admin_settings_hooks'), request=request)}
<div class="form">
<div class="fields">

2
rhodecode/templates/admin/settings/settings_issuetracker.mako
View file

@ -5,7 +5,7 @@
<h3 class="panel-title">${_('Issue Tracker / Wiki Patterns')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.url('admin_settings_issuetracker_save'), method='post')}
${h.secure_form(h.url('admin_settings_issuetracker_save'), request=request)}
${its.issue_tracker_settings_table(
patterns=c.issuetracker_entries.items(),
form_url=h.url('admin_settings_issuetracker'),

2
rhodecode/templates/admin/settings/settings_labs.mako
View file

@ -3,7 +3,7 @@
<h3 class="panel-title">${_('Labs Settings')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.url('admin_settings_labs'), method='post')}
${h.secure_form(h.url('admin_settings_labs'), request=request)}
<div class="form">
<div class="fields">
% if not c.lab_settings:

2
rhodecode/templates/admin/settings/settings_mapping.mako
View file

@ -1,4 +1,4 @@
${h.secure_form(h.url('admin_settings_mapping'), method='post')}
${h.secure_form(h.url('admin_settings_mapping'), request=request)}
<div class="panel panel-default">
<div class="panel-heading">

2
rhodecode/templates/admin/settings/settings_sessions.mako
View file

@ -28,7 +28,7 @@
<h3 class="panel-title">${_('Cleanup Old Sessions')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='POST', request=request)}
${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), request=request)}
<p>
${_('Cleanup user sessions that were not active during chosen time frame.')} <br/>

2
rhodecode/templates/admin/settings/settings_vcs.mako
View file

@ -1,6 +1,6 @@
<%namespace name="vcss" file="/base/vcs_settings.mako"/>
${h.secure_form(h.url('admin_settings_vcs'), method='post')}
${h.secure_form(h.url('admin_settings_vcs'), request=request)}
<div>
${vcss.vcs_settings_fields(
suffix='',

2
rhodecode/templates/admin/settings/settings_visual.mako
View file

@ -1,4 +1,4 @@
${h.secure_form(h.url('admin_settings_visual'), method='post')}
${h.secure_form(h.url('admin_settings_visual'), request=request)}
<div class="panel panel-default">
<div class="panel-heading" id="general">

2
rhodecode/templates/admin/user_groups/user_group_add.mako
View file

@ -26,7 +26,7 @@
${self.breadcrumbs()}
</div>
<!-- end box / title -->
${h.secure_form(h.route_path('user_groups_create'), method='POST', request=request)}
${h.secure_form(h.route_path('user_groups_create'), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

4
rhodecode/templates/admin/user_groups/user_group_edit_advanced.mako
View file

@ -44,7 +44,7 @@
% endif
<div>
${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), request=request)}
<div class="field">
<button class="btn btn-default" type="submit">
%if sync_type:
@ -72,7 +72,7 @@
<h3 class="panel-title">${_('Delete User Group')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), request=request)}
${h.hidden('force', 1)}
<button class="btn btn-small btn-danger" type="submit"
onclick="return confirm('${_('Confirm to delete user group `%(ugroup)s` with all permission assignments') % {'ugroup': c.user_group.users_group_name}}');">

2
rhodecode/templates/admin/user_groups/user_group_edit_perms.mako
View file

@ -5,7 +5,7 @@
<h3 class="panel-title">${_('User Group Permissions')}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), request=request)}
<table id="permissions_manage" class="rctable permissions">
<tr>
<th class="td-radio">${_('None')}</th>

2
rhodecode/templates/admin/user_groups/user_group_edit_settings.mako
View file

@ -6,7 +6,7 @@
<h3 class="panel-title">${_('User Group: %s') % c.user_group.users_group_name}</h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', method='POST', request=request)}
${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

4
rhodecode/templates/admin/users/user_edit_auth_tokens.mako
View file

@ -38,7 +38,7 @@
%endif
</td>
<td class="td-action">
${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), request=request)}
${h.hidden('del_auth_token', auth_token.user_api_key_id)}
<button class="btn btn-link btn-danger" type="submit"
onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
@ -55,7 +55,7 @@
</div>
<div class="user_auth_tokens">
${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), request=request)}
<div class="form form-vertical">
<!-- fields -->
<div class="fields">

4
rhodecode/templates/admin/users/user_edit_emails.mako
View file

@ -24,7 +24,7 @@
<span class="user email">${em.email}</span>
</td>
<td class="td-action">
${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), request=request)}
${h.hidden('del_email_id', em.email_id)}
<button class="btn btn-link btn-danger" type="submit"
onclick="return confirm('${_('Confirm to delete this email: %s') % em.email}');">
@ -46,7 +46,7 @@
</table>
</div>
${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/admin/users/user_edit_groups.mako
View file

@ -19,7 +19,7 @@
</div>
<div class="groups_management">
${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), request=request)}
<div id="repos_list_wrap">
<table id="user_group_list_table" class="display"></table>
</div>

4
rhodecode/templates/admin/users/user_edit_ips.mako
View file

@ -30,7 +30,7 @@
<td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
<td class="td-description"><div class="ip">${ip.description}</div></td>
<td class="td-action">
${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), request=request)}
${h.hidden('del_ip_id', ip.ip_id)}
${h.submit('remove_', _('Delete'),id="remove_ip_%s" % ip.ip_id,
class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
@ -51,7 +51,7 @@
</div>
<div>
${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

4
rhodecode/templates/admin/users/user_edit_ssh_keys.mako
View file

@ -21,7 +21,7 @@
<td class="td-tags">${h.format_date(ssh_key.created_on)}</td>
<td class="td-action">
${h.secure_form(h.route_path('edit_user_ssh_keys_delete', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_ssh_keys_delete', user_id=c.user.user_id), request=request)}
${h.hidden('del_ssh_key', ssh_key.ssh_key_id)}
<button class="btn btn-link btn-danger" type="submit"
onclick="return confirm('${_('Confirm to remove ssh key %s') % ssh_key.ssh_key_fingerprint}');">
@ -38,7 +38,7 @@
</div>
<div class="user_ssh_keys">
${h.secure_form(h.route_path('edit_user_ssh_keys_add', user_id=c.user.user_id), method='POST', request=request)}
${h.secure_form(h.route_path('edit_user_ssh_keys_add', user_id=c.user.user_id), request=request)}
<div class="form form-vertical">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/base/default_perms_box.mako
View file

@ -94,7 +94,7 @@
</%def>
<%def name="default_perms_box(form_url)">
${h.secure_form(form_url, method='POST', request=request)}
${h.secure_form(form_url, request=request)}
<div class="form">
<div class="fields">
<div class="field panel panel-default panel-body">

6
rhodecode/templates/data_table/_dt_elements.mako
View file

@ -167,7 +167,7 @@
<i class="icon-pencil"></i>Edit</a>
</div>
<div class="grid_delete">
${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), request=request)}
${h.submit('remove_%s' % repo_name,_('Delete'),class_="btn btn-link btn-danger",
onclick="return confirm('"+_('Confirm to delete this repository: %s') % repo_name+"');")}
${h.end_form()}
@ -240,7 +240,7 @@
<a href="${h.url('edit_repo_group',group_name=repo_group_name)}" title="${_('Edit')}">Edit</a>
</div>
<div class="grid_delete">
${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete')}
${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete', request=request)}
${h.submit('remove_%s' % repo_group_name,_('Delete'),class_="btn btn-link btn-danger",
onclick="return confirm('"+_ungettext('Confirm to delete this group: %s with %s repository','Confirm to delete this group: %s with %s repositories',gr_count) % (repo_group_name, gr_count)+"');")}
${h.end_form()}
@ -266,7 +266,7 @@
<a href="${h.route_path('edit_user_group', user_group_id=user_group_id)}" title="${_('Edit')}">Edit</a>
</div>
<div class="grid_delete">
${h.secure_form(h.route_path('user_groups_delete', user_group_id=user_group_id), method='POST', request=request)}
${h.secure_form(h.route_path('user_groups_delete', user_group_id=user_group_id), request=request)}
${h.submit('remove_',_('Delete'),id="remove_group_%s" % user_group_id, class_="btn btn-link btn-danger",
onclick="return confirm('"+_('Confirm to delete this user group: %s') % user_group_name+"');")}
${h.end_form()}

4
rhodecode/templates/files/files_add.mako
View file

@ -27,7 +27,7 @@
<div class="edit-file-title">
${self.breadcrumbs()}
</div>
${h.secure_form(h.route_path('repo_files_create_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', enctype="multipart/form-data", class_="form-horizontal", request=request)}
${h.secure_form(h.route_path('repo_files_create_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', enctype="multipart/form-data", class_="form-horizontal", request=request)}
<div class="edit-file-fieldset">
<div class="fieldset">
<div id="destination-label" class="left-label">
@ -121,7 +121,7 @@
button.addClass('clicked');
}
});
$('#specify-custom-path').on('click', function(e){
e.preventDefault();
$('#specify-custom-path-container').hide();

2
rhodecode/templates/files/files_delete.mako
View file

@ -27,7 +27,7 @@
<div class="edit-file-title">
${self.breadcrumbs()}
</div>
${h.secure_form(h.route_path('repo_files_delete_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', class_="form-horizontal", request=request)}
${h.secure_form(h.route_path('repo_files_delete_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', class_="form-horizontal", request=request)}
<div class="edit-file-fieldset">
<div class="fieldset">
<div id="destination-label" class="left-label">

2
rhodecode/templates/files/files_edit.mako
View file

@ -42,7 +42,7 @@
</div>
<div class="table">
${h.secure_form(h.route_path('repo_files_update_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', request=request)}
${h.secure_form(h.route_path('repo_files_update_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', request=request)}
<div id="codeblock" class="codeblock" >
<div class="code-header">
<div class="stats">

2
rhodecode/templates/forks/fork.mako
View file

@ -27,7 +27,7 @@
${self.breadcrumbs()}
</div>
${h.secure_form(h.route_path('repo_fork_create',repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
${h.secure_form(h.route_path('repo_fork_create',repo_name=c.rhodecode_db_repo.repo_name), request=request)}
<div class="form">
<!-- fields -->
<div class="fields">

2
rhodecode/templates/pullrequests/pullrequest.mako
View file

@ -22,7 +22,7 @@
${self.repo_page_title(c.rhodecode_db_repo)}
</div>
${h.secure_form(h.route_path('pullrequest_create', repo_name=c.repo_name, _query=request.GET.mixed()), id='pull_request_form', method='POST', request=request)}
${h.secure_form(h.route_path('pullrequest_create', repo_name=c.repo_name, _query=request.GET.mixed()), id='pull_request_form', request=request)}
${self.breadcrumbs()}

2
rhodecode/templates/pullrequests/pullrequest_merge_checks.mako
View file

@ -47,7 +47,7 @@
% endif
<div>
${h.secure_form(h.route_path('pullrequest_merge', repo_name=c.repo_name, pull_request_id=c.pull_request.pull_request_id), id='merge_pull_request_form', method='POST', request=request)}
${h.secure_form(h.route_path('pullrequest_merge', repo_name=c.repo_name, pull_request_id=c.pull_request.pull_request_id), id='merge_pull_request_form', request=request)}
<% merge_disabled = ' disabled' if c.pr_merge_possible is False else '' %>
<a class="btn" href="#" onclick="refreshMergeChecks(); return false;">${_('refresh checks')}</a>
<input type="submit" id="merge_pull_request" value="${_('Merge Pull Request')}" class="btn${merge_disabled}"${merge_disabled}>

2
rhodecode/templates/pullrequests/pullrequest_show.mako
View file

@ -52,7 +52,7 @@
%if c.allowed_to_update:
<div id="delete_pullrequest" class="pull-right action_button ${'' if c.allowed_to_delete else 'disabled' }" style="clear:inherit;padding: 0">
% if c.allowed_to_delete:
${h.secure_form(h.route_path('pullrequest_delete', repo_name=c.pull_request.target_repo.repo_name, pull_request_id=c.pull_request.pull_request_id), method='POST', request=request)}
${h.secure_form(h.route_path('pullrequest_delete', repo_name=c.pull_request.target_repo.repo_name, pull_request_id=c.pull_request.pull_request_id), request=request)}
${h.submit('remove_%s' % c.pull_request.pull_request_id, _('Delete'),
class_="btn btn-link btn-danger no-margin",onclick="return confirm('"+_('Confirm to delete this pull request')+"');")}
${h.end_form()}