darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-23 15:57:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

Don’t populate support form with arbitrary text

Browse Source 
I don’t think it’s a massive risk (we’re certainly mitigating against
any XSS), but having a page on a GOV.UK domain where you can prefill
text on the page from a query string probably isn’t great.

So this commit restricts prefilling the support form to a set of
named questions.
This commit is contained in:
Chris Hill-Scott
2018-03-20 10:41:58 +00:00
parent a6eeb3cd73
commit 64b5f03dcd
5 changed files with 62 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/templates/views/pricing.html
View File

@@ -125,7 +125,7 @@
<h2 class="heading-medium" id="paying">How to pay</h2>
<p>You can find details of how to pay for Notify in our data sharing and financial agreement.</p>
<p>
<a href="{{url_for('.feedback', ticket_type='ask-question-give-feedback', body='Please send me a copy of the GOV.UK Notify data sharing and financial agreement.')}}">Contact us</a> to get a copy of the agreement
<a href="{{url_for('.feedback', ticket_type='ask-question-give-feedback', body='agreement')}}">Contact us</a> to get a copy of the agreement
{% if agreement_info.agreement_signed %}
({{ agreement_info.owner }} has already accepted it).
{% else %}

4
app/templates/views/terms-of-use.html
View File

@@ -28,10 +28,10 @@ Terms of use
{% if agreement_info.owner %}
({{ agreement_info.owner }})
must also accept our data sharing and financial agreement.
<a href="{{ url_for('.feedback', ticket_type='ask-question-give-feedback', body='Please send me a copy of the GOV.UK Notify data sharing and financial agreement for {} to sign.'.format(agreement_info.owner)) }}">Contact us</a> to get a copy.
<a href="{{ url_for('.feedback', ticket_type='ask-question-give-feedback', body='agreement-with-owner') }}">Contact us</a> to get a copy.
{% else %}
must also accept our data sharing and financial agreement.
<a href="{{ url_for('.feedback', ticket_type='ask-question-give-feedback', body='Please send me a copy of the GOV.UK Notify data sharing and financial agreement.') }}">Contact us</a> to get a copy.
<a href="{{ url_for('.feedback', ticket_type='ask-question-give-feedback', body='agreement') }}">Contact us</a> to get a copy.
{% endif %}
</p>
{% endif %}