From 4a34d78093052fde921d5c73ba96673515441b8b Mon Sep 17 00:00:00 2001 From: Dan Scott Date: Sat, 10 Mar 2012 12:36:08 -0500 Subject: [PATCH] TPAC: Teach mkurl() to discard POST params Unless we explicitly ask for POST params with the "params" argument to mkurl(), prevent them from propagating. (Can't think of situations when we would want to propagate a POST param, but we err on the side of flexibility so...) Thanks to Thomas Berezansky for suggesting the CGI url_param() method of filtering POST params. Signed-off-by: Dan Scott Signed-off-by: Thomas Berezansky --- Open-ILS/src/templates/opac/parts/header.tt2 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Open-ILS/src/templates/opac/parts/header.tt2 b/Open-ILS/src/templates/opac/parts/header.tt2 index 30dbd6def6..5db8139ca0 100644 --- a/Open-ILS/src/templates/opac/parts/header.tt2 +++ b/Open-ILS/src/templates/opac/parts/header.tt2 @@ -57,6 +57,11 @@ FOR p IN cgi.param; val = cgi.param(p); IF val == ''; cgi.delete(p); END; + + # Delete POST vars unless we asked for them + UNLESS CGI.url_param(p) OR params.defined(p); + cgi.delete(p); + END; END; IF page; -- 2.11.0