mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-08-03 13:18:57 -04:00
e65dcbe199
Phone numbers and email addresses are showing up in URLs where we let users search for sent notifications by phone number or email address. `GET` requests put the form data as a query string in the URL. This is problematic when people are searching by a recipient’s phone number or email address, because the URL may show up: - in our server logs - in our analytics - in the user’s browser history This is bad because these are all places where we don’t want people’s personal information. It’s not too bad when this is happening a handful of times. But it would be bad if we kept aggregating this information because it would allow us to track users across services. So, while it’s not especially RESTful, it’s better for the search form to submit as a `POST` request. This way the phone number or email address goes in the body of the request and does not show up in the URL.
49 lines
1.6 KiB
HTML
49 lines
1.6 KiB
HTML
{% extends "withnav_template.html" %}
|
|
{% from "components/ajax-block.html" import ajax_block %}
|
|
{% from "components/message-count-label.html" import message_count_label, recipient_count_label %}
|
|
{% from "components/page-footer.html" import page_footer %}
|
|
{% from "components/textbox.html" import textbox %}
|
|
|
|
{% block service_page_title %}
|
|
{{ message_count_label(99, message_type, suffix='') | capitalize }}
|
|
{% endblock %}
|
|
|
|
{% block maincolumn_content %}
|
|
|
|
<h1 class="heading-large">
|
|
{{ message_count_label(99, message_type, suffix='') | capitalize }}
|
|
</h1>
|
|
|
|
{{ ajax_block(
|
|
partials,
|
|
url_for('.get_notifications_as_json', service_id=current_service.id, message_type=message_type, status=status),
|
|
'counts'
|
|
) }}
|
|
|
|
<form
|
|
method="post"
|
|
action="{{ url_for('.view_notifications', service_id=current_service.id, message_type=message_type) }}"
|
|
class="grid-row"
|
|
>
|
|
<div class="column-three-quarters">
|
|
<input type="hidden" name="status" value="{{ status }}">
|
|
{{ textbox(
|
|
search_form.to,
|
|
width='1-1',
|
|
label='Search by {}'.format('email address' if message_type == 'email' else 'phone number')
|
|
) }}
|
|
</div>
|
|
<div class="column-one-quarter align-button-with-textbox">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
|
|
<input type="submit" class="button" value="Search">
|
|
</div>
|
|
</form>
|
|
|
|
{{ ajax_block(
|
|
partials,
|
|
url_for('.get_notifications_as_json', service_id=current_service.id, message_type=message_type, status=status, page=page, to=to),
|
|
'notifications'
|
|
) }}
|
|
|
|
{% endblock %}
|