mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-08-25 00:33:58 -04:00
Don’t populate support form with arbitrary text
I don’t think it’s a massive risk (we’re certainly mitigating against any XSS), but having a page on a GOV.UK domain where you can prefill text on the page from a query string probably isn’t great. So this commit restricts prefilling the support form to a set of named questions.
This commit is contained in:
@@ -125,7 +125,7 @@
|
||||
<h2 class="heading-medium" id="paying">How to pay</h2>
|
||||
<p>You can find details of how to pay for Notify in our data sharing and financial agreement.</p>
|
||||
<p>
|
||||
<a href="{{url_for('.feedback', ticket_type='ask-question-give-feedback', body='Please send me a copy of the GOV.UK Notify data sharing and financial agreement.')}}">Contact us</a> to get a copy of the agreement
|
||||
<a href="{{url_for('.feedback', ticket_type='ask-question-give-feedback', body='agreement')}}">Contact us</a> to get a copy of the agreement
|
||||
{% if agreement_info.agreement_signed %}
|
||||
({{ agreement_info.owner }} has already accepted it).
|
||||
{% else %}
|
||||
|
||||
Reference in New Issue
Block a user