diff options
| author | Michael Hamann <michael@content-space.de> | 2011-05-24 22:38:27 +0200 |
|---|---|---|
| committer | Michael Hamann <michael@content-space.de> | 2011-05-24 22:42:13 +0200 |
| commit | 31bc8f119cd896f19085ea120b89356393d4f8e6 (patch) | |
| tree | 052d634e73d3c90aa386200b6ec00a03f839f5b4 /lib/scripts/edit.js | |
| parent | 76388d5c9afc51bec28898bfa445600b5e5711bc (diff) | |
| download | rpg-31bc8f119cd896f19085ea120b89356393d4f8e6.tar.gz rpg-31bc8f119cd896f19085ea120b89356393d4f8e6.tar.bz2 | |
Check permissions + security token in lock + draft modification FS#2265
This disables lock and draft creation for pages the user can't edit. It
additionally adds a security token to the draft creation and deletion
request so - at least for logged in users - drafts can't be created,
modified or deleted so easily anymore.
Diffstat (limited to 'lib/scripts/edit.js')
| -rw-r--r-- | lib/scripts/edit.js | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/lib/scripts/edit.js b/lib/scripts/edit.js index a96a346dc..31afcc126 100644 --- a/lib/scripts/edit.js +++ b/lib/scripts/edit.js @@ -275,6 +275,7 @@ function deleteDraft() { if(dwform){ var params = 'call=draftdel'; params += '&id='+encodeURIComponent(dwform.elements.id.value); + params += '§ok='+encodeURIComponent(dwform.elements.sectok.value); var sackobj = new sack(DOKU_BASE + 'lib/exe/ajax.php'); // this needs to be synchronous and GET to not be aborted upon page unload |