From 67f45cfa781ef4b446676e199470e421f5463812 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 11 Sep 2010 01:46:45 -0700
Subject: Add CSRF protection to the upgrader.  And update the CLI output so
 that it tells you which modules failed to upgrade properly.  Fixes ticket
 #1359.

---
 modules/gallery/views/upgrader.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/upgrader.html.php b/modules/gallery/views/upgrader.html.php
index c2d8a552..554cf30d 100644
--- a/modules/gallery/views/upgrader.html.php
+++ b/modules/gallery/views/upgrader.html.php
@@ -84,7 +84,7 @@
         </div>
         <? else: ?>
         <div id="upgrade_button" class="button button-active">
-          <a id="upgrade_link" href="<?= url::site("upgrader/upgrade") ?>">
+          <a id="upgrade_link" href="<?= url::site("upgrader/upgrade?csrf=__CSRF__") ?>">
             <?= t("Upgrade all") ?>
           </a>
         </div>
-- 
cgit v1.2.3


From 14ae1fde25eb8b22a2fc92453ba12c8e74aba433 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sat, 11 Sep 2010 10:41:47 -0700
Subject: Use the actual csrf token, not the placeholder (url::site doesn't
 replace that).  Fixes ticket #1361

---
 modules/gallery/views/upgrader.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/upgrader.html.php b/modules/gallery/views/upgrader.html.php
index 554cf30d..1ec49c77 100644
--- a/modules/gallery/views/upgrader.html.php
+++ b/modules/gallery/views/upgrader.html.php
@@ -84,7 +84,7 @@
         </div>
         <? else: ?>
         <div id="upgrade_button" class="button button-active">
-          <a id="upgrade_link" href="<?= url::site("upgrader/upgrade?csrf=__CSRF__") ?>">
+          <a id="upgrade_link" href="<?= url::site("upgrader/upgrade?csrf=" . access::csrf_token()) ?>">
             <?= t("Upgrade all") ?>
           </a>
         </div>
-- 
cgit v1.2.3