From 0b1c18270301b1e4b741c1c6a89480b813965726 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 14 Feb 2017 15:24:25 +0100
Subject: [PATCH] Fix nested hidden inputs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We do not want to inject token there.

Fixes #12999

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/URL.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libraries/URL.php b/libraries/URL.php
index 0cafca84eb..c26491f8d2 100644
--- a/libraries/URL.php
+++ b/libraries/URL.php
@@ -112,8 +112,10 @@ class URL
     {
         $fields = '';
 
-        /* Always include token */
-        $values['token'] = $_SESSION[' PMA_token '];
+        /* Always include token in plain forms */
+        if ($pre === '') {
+            $values['token'] = $_SESSION[' PMA_token '];
+        }
 
         foreach ($values as $name => $value) {
             if (! empty($pre)) {