From e2100a57c6bbaaadfed1bfc64ea69ab67ead027a Mon Sep 17 00:00:00 2001
From: marcus <marcus@36083f99-b078-4883-b0ff-0f9b5a30f544>
Date: Wed, 6 Aug 2008 11:28:01 +0000
Subject: Refs #210 and #211

git-svn-id: https://code.elgg.org/elgg/trunk@1731 36083f99-b078-4883-b0ff-0f9b5a30f544
---
 views/default/input/form.php | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

(limited to 'views/default/input/form.php')

diff --git a/views/default/input/form.php b/views/default/input/form.php
index 1f15b046f..5e4c7b001 100644
--- a/views/default/input/form.php
+++ b/views/default/input/form.php
@@ -17,15 +17,22 @@
 	 * @uses $vars['action'] URL of the action being called
 	 * 
 	 */
-
-$body = $vars['body'];
-$action = $vars['action'];
-$enctype = $vars['enctype'];
-$method = $vars['method']; if (!$method) $method = 'POST';
+	
+	$body = $vars['body'];
+	$action = $vars['action'];
+	$enctype = $vars['enctype'];
+	$method = $vars['method']; if (!$method) $method = 'POST';
 
 // TODO: Token generation
 
+	// Generate a security header
+	$ts = time();
+	$token = generate_action_token($action, $ts);
+	$security_header = elgg_view('input/hidden', array('internalname' => '__elgg_token', 'value' => $token));
+	$security_header .= elgg_view('input/hidden', array('internalname' => '__elgg_action', 'value' => $action));
+	$security_header .= elgg_view('input/hidden', array('internalname' => '__elgg_ts', 'value' => $ts));
 ?>
 <form action="<?php echo $action; ?>" method="<?php echo $method; ?>" <?php if ($enctype!="") echo "enctype=\"$enctype\""; ?>>
+<?php echo $security_header; ?>
 <?php echo $body; ?>
 </form>
\ No newline at end of file
-- 
cgit v1.2.3