This patch avoids generating CSRF tokens unless the csrf-token.inc file is included in the template. Passed token doesn't need HTML escaped. The docs for WWW::CSRF state: The returned CSRF token is in a text-only form suitable for inserting into a HTML form without further escaping (assuming you did not send in strange things to the Time option). Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> (cherry picked from commit ddf1eb6cef14da365675890920ff72f010c59527) Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com> (cherry picked from commit 73ca151686b682aaa2b950ccbc89fcec14514112) Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> |
||
|---|---|---|
| .. | ||
| AdditionalContents.pm | ||
| Asset.pm | ||
| AudioAlerts.pm | ||
| AuthClient.pm | ||
| AuthorisedValues.pm | ||
| Biblio.pm | ||
| Branches.pm | ||
| Cache.pm | ||
| Categories.pm | ||
| CirculationRules.pm | ||
| Context.pm | ||
| Desks.pm | ||
| HtmlId.pm | ||
| HtmlTags.pm | ||
| I18N.pm | ||
| ItemTypes.pm | ||
| Koha.pm | ||
| KohaDates.pm | ||
| KohaPlugins.pm | ||
| KohaSpan.pm | ||
| Languages.pm | ||
| Price.pm | ||
| Registers.pm | ||
| Remove_MARC_punctuation.pm | ||
| TablesSettings.pm | ||
| To.pm | ||
| raw.pm | ||