haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1620 from jezen/master

Browse Source 
Move JavaScript form submission to script block
This commit is contained in:
Michael Snoyman 2019-08-20 09:08:55 +03:00 committed by GitHub
commit 56e85572d4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
yesod-core/ChangeLog.md
View File

@ -1,5 +1,10 @@
# ChangeLog for yesod-core # ChangeLog for yesod-core
## 1.6.15
* Move `redirectToPost` JavaScript form submission from HTML element to
`<script>` tag for CSP reasons [#1620](https://github.com/yesodweb/yesod/pull/1620)
## 1.6.14 ## 1.6.14
* Introduce `JSONResponse`. [issue #1481](https://github.com/yesodweb/yesod/issues/1481) and [PR #1592](https://github.com/yesodweb/yesod/pull/1592) * Introduce `JSONResponse`. [issue #1481](https://github.com/yesodweb/yesod/issues/1481) and [PR #1592](https://github.com/yesodweb/yesod/pull/1592)

4
yesod-core/src/Yesod/Core/Handler.hs
View File

@ -1069,13 +1069,15 @@ $doctype 5
<html> <html>
<head> <head>
<title>Redirecting... <title>Redirecting...
<body onload="document.getElementById('form').submit()"> <body>
<form id="form" method="post" action=#{urlText}> <form id="form" method="post" action=#{urlText}>
$maybe token <- reqToken req $maybe token <- reqToken req
<input type=hidden name=#{defaultCsrfParamName} value=#{token}> <input type=hidden name=#{defaultCsrfParamName} value=#{token}>
<noscript> <noscript>
<p>Javascript has been disabled; please click on the button below to be redirected. <p>Javascript has been disabled; please click on the button below to be redirected.
<input type="submit" value="Continue"> <input type="submit" value="Continue">
<script>
window.onload = function() { document.getElementById('form').submit(); };
|] >>= sendResponse |] >>= sendResponse
-- | Wraps the 'Content' generated by 'hamletToContent' in a 'RepHtml'. -- | Wraps the 'Content' generated by 'hamletToContent' in a 'RepHtml'.

2
yesod-core/yesod-core.cabal
View File

@ -1,5 +1,5 @@
name: yesod-core name: yesod-core
version: 1.6.14 version: 1.6.15
license: MIT license: MIT
license-file: LICENSE license-file: LICENSE
author: Michael Snoyman <michael@snoyman.com> author: Michael Snoyman <michael@snoyman.com>