darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-04 08:08:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix missing CSRF token on send SMS page

Browse Source 
As part of https://github.com/alphagov/notifications-admin/pull/187 the file
upload pattern was changed to auto-submit once a file had been picked. The
form that was submitted was, however, missing a CSRF token, as well as a submit
button for non-JS users.

This commit makes the file upload pattern self-contained, so that it will always
include a form with a CSRF token in a hidden input and a submit button, which is
then hidden when Javascript loads.
This commit is contained in:
Chris Hill-Scott
2016-02-22 21:37:32 +00:00
parent 7280e90c26
commit 16fbfe49a3
6 changed files with 28 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/templates/views/send-sms.html
View File

@@ -12,19 +12,16 @@
<h1 class="heading-large">Add recipients</h1>
<form method="POST" enctype="multipart/form-data">
<div class="grid-row">
<div class="column-two-thirds">
{{ sms_message(template.formatted_as_markup) }}
</div>
<div class="grid-row">
<div class="column-two-thirds">
{{ sms_message(template.formatted_as_markup) }}
</div>
</div>
<p>
<a href="{{ url_for('.get_example_csv', service_id=service_id, template_id=template.id) }}">Download an example CSV file</a>
</p>
<p>
<a href="{{ url_for('.get_example_csv', service_id=service_id, template_id=template.id) }}">Download an example CSV file</a>
</p>
{{file_upload(form.file, button_text='Upload a CSV file')}}
{{file_upload(form.file, button_text='Upload a CSV file')}}
</form>
{% endblock %}