This is necessary to avoid CSRF on SQL queries. This is really more a
short term fix, proper fix (to be implemented in master) is to avoid
accepting SQL queries from GET requests.
This reverts commits:
* dae3390a02
* ea73fded71
* 90433788d6
* f797a8d87d
* 9c1cfc8553
Signed-off-by: Michal Čihař <michal@cihar.com>
This will fix few broken users:
- error reporting
- table search in navigation
- user preferences
Fixes#12964
Signed-off-by: Michal Čihař <michal@cihar.com>
Don't append the parameters in query string while building the HTML; was going awry when URL::getCommon() returned blank
Fix#12463
More instances of such appending of URL parameters which are present in the codebase,
have to fixed.
ChangeLog entry for #12463
Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
The CSRF token really should be used only in POST requests. The reason
for that is that it's a bit harder to get to if it is in request body
(with POST) compared to GET request, where it is in the URL (being
easily available in server logs).
Also this will make the URLs look nicer ;-).
This change will definite break some functionality, but since #6297 most
of the code should be safe and remaining bugs can be fixed for upcoming
release.
Signed-off-by: Michal Čihař <michal@cihar.com>
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.
Also I've fixed several wrong uses of the HTML encoded variant in
Location header.
Signed-off-by: Michal Čihař <michal@cihar.com>
