bind security token to username

This makes the security token more robust agains session fixation
attacks. A CSRF warning will no longer abort a page save but lead to the
preview mode to avoid information loss when a user logs in during
editing (eg in another tab).

1 files changed, 1 insertions, 1 deletions

diff --git a/inc/actions.php b/inc/actions.php
index 1a0ae4028..ddfafc554 100644
--- a/inc/actions.php
+++ b/inc/actions.php
@@ -101,7 +101,7 @@ function act_dispatch(){
             if(checkSecurityToken()){
                 $ACT = act_save($ACT);
             }else{
-                $ACT = 'show';
+                $ACT = 'preview';
             }
         }