The CSRF token really should be used only in POST requests. The reason
for that is that it's a bit harder to get to if it is in request body
(with POST) compared to GET request, where it is in the URL (being
easily available in server logs).
Also this will make the URLs look nicer ;-).
This change will definite break some functionality, but since #6297 most
of the code should be safe and remaining bugs can be fixed for upcoming
release.
Signed-off-by: Michal Čihař <michal@cihar.com>
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.
Also I've fixed several wrong uses of the HTML encoded variant in
Location header.
Signed-off-by: Michal Čihař <michal@cihar.com>
