Only POST Form widgets send a session token.

2014-05-18 20:19:05 +02:00 · 2014-05-18 20:19:05 +02:00 · d56d97a439
commit d56d97a439
parent bfaa700763
2 changed files with 3 additions and 6 deletions
--- a/lib/form.php
+++ b/lib/form.php
@ -91,8 +91,10 @@ class Form extends Widget

    function sessionToken()
    {
+        if (strtolower($this->method()) == 'post') {
            $this->out->hidden('token-' . $this->id() ?: common_random_hexstr(3), common_session_token(), 'token');
        }
+    }

    /**
     * Name of the form
--- a/lib/searchform.php
+++ b/lib/searchform.php
@ -106,9 +106,4 @@ class SearchForm extends Form
    {
        return 'get';
    }
-
-    function sessionToken()
-    {
-        return;
-    }
 }