Protect the web interface against CSRF, and the CSRF token against BREACH.

[itkacl] / itkacl-web-1.0 / web / view.pl

diff --git a/itkacl-web-1.0/web/view.pl b/itkacl-web-1.0/web/view.pl
index a79320c98835fc67edd99d63e3868d8411f1b63f..ec8349396a752756f8b23c360218d4ab21b9e242 100755 (executable)
--- a/itkacl-web-1.0/web/view.pl
+++ b/itkacl-web-1.0/web/view.pl
@@ -136,11 +136,11 @@ EOF
     <td>$et_text</td>
     <td>$e_text</td>
     <td style="text-align: center;">
-      <a href="/delete.pl?entry=$entry&amp;entity_type=$entity_type&amp;entity=$e_text">
+      <a href="/delete.pl?entry=$entry&amp;entity_type=$entity_type&amp;entity=$e_text&amp;csrftoken=$itkaclcommon::masked_csrf_token">
         <img src="/img/delete.png" alt="Slett" />
       </a>
     </td>
-    <td ondblclick="enableEdit(this);" itkacl:entry="$entry" itkacl:entity-type="$entity_type" itkacl:entity="$e_text">$c_text</td>
+    <td ondblclick="enableEdit(this);" itkacl:entry="$entry" itkacl:entity-type="$entity_type" itkacl:entity="$e_text" itkacl:csrftoken="$itkaclcommon::masked_csrf_token">$c_text</td>
   </tr>
 EOF
 }
@@ -167,6 +167,7 @@ print <<"EOF";
 <p>Den spesielle gruppen "&lt;everyone&gt;" inneholder alle brukere.</p>
 
 <form method="post" action="add.pl">
+  <input type="hidden" name="csrftoken" value="$itkaclcommon::masked_csrf_token" />
   <input type="hidden" name="entry" value="$entry" />
   <table>
     <tr style="text-align: left;">
@@ -210,6 +211,7 @@ print <<"EOF";
   er case-sensitive) samt tall og bindestrek.</p>
 
 <form method="post" action="addnode.pl">
+  <input type="hidden" name="csrftoken" value="$itkaclcommon::masked_csrf_token" />
   <input type="hidden" name="parent" value="$entry" />
   <table>
     <tr style="text-align: left;">
@@ -255,6 +257,7 @@ EOF
   feile, så sjekk grundig før du sletter det at det ikke fortsatt er i bruk.</p>
   
 <form method="post" action="deletenode.pl">
+  <input type="hidden" name="csrftoken" value="$itkaclcommon::masked_csrf_token" />
   <input type="hidden" name="entry" value="$entry" />
   <p><input type="submit" value="Slett dette området" /></p>
 </form>