From 228dedb767db77cd220bc5863c125aec1aa93f06 Mon Sep 17 00:00:00 2001
From: marcus <marcus@36083f99-b078-4883-b0ff-0f9b5a30f544>
Date: Fri, 24 Apr 2009 14:53:28 +0000
Subject: Introducing input/securitytoken as an intermediate step for form
 conversion.

git-svn-id: https://code.elgg.org/elgg/trunk@3235 36083f99-b078-4883-b0ff-0f9b5a30f544
---
 views/default/input/form.php          |  5 +----
 views/default/input/securitytoken.php | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 4 deletions(-)
 create mode 100644 views/default/input/securitytoken.php

(limited to 'views/default/input')

diff --git a/views/default/input/form.php b/views/default/input/form.php
index da666318d..a7ba8e45f 100644
--- a/views/default/input/form.php
+++ b/views/default/input/form.php
@@ -29,10 +29,7 @@
 	$security_header = "";
 	if ($vars['disable_security']!=true)
 	{
-		$ts = time();
-		$token = generate_action_token($ts);
-		$security_header = elgg_view('input/hidden', array('internalname' => '__elgg_token', 'value' => $token));
-		$security_header .= elgg_view('input/hidden', array('internalname' => '__elgg_ts', 'value' => $ts));
+		$security_header = elgg_view('input/securitytoken');
 	}
 ?>
 <form <?php if ($id) { ?>id="<?php echo $id; ?>" <?php } ?> <?php if ($name) { ?>name="<?php echo $name; ?>" <?php } ?> action="<?php echo $action; ?>" method="<?php echo $method; ?>" <?php if ($enctype!="") echo "enctype=\"$enctype\""; ?>>
diff --git a/views/default/input/securitytoken.php b/views/default/input/securitytoken.php
new file mode 100644
index 000000000..b1461a2ce
--- /dev/null
+++ b/views/default/input/securitytoken.php
@@ -0,0 +1,20 @@
+<?php
+	/**
+	 * CSRF security token view for use with secure forms.
+	 * 
+	 * It is still recommended that you use input/form.
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008-2009
+	 * @link http://elgg.org/
+	 */
+
+	$ts = time();
+	$token = generate_action_token($ts);
+	
+	echo elgg_view('input/hidden', array('internalname' => '__elgg_token', 'value' => $token));
+	echo elgg_view('input/hidden', array('internalname' => '__elgg_ts', 'value' => $ts));
+?>
-- 
cgit v1.2.3