diff options
| author | Louise Crow <louise.crow@gmail.com> | 2015-04-09 18:39:23 +0100 |
|---|---|---|
| committer | Louise Crow <louise.crow@gmail.com> | 2015-04-10 12:09:19 +0100 |
| commit | 24a91a3dc095a0d55cb6b4ddf3c6a68726228f54 (patch) | |
| tree | d5caef54c33eb13a1d5a53a24294ad12d802495a /app | |
| parent | af4e1ad526804ae15df49221668e00f5f0389085 (diff) | |
Use GET for search forms, not POST.
Now that we use global CSRF authenticity checks, searches were logging
logged-in users out as the form is an HTML form, not a Rails-generated
form with a CSRF token. So form submission raised an InvalidAuthenticityToken
error and reset their session. We could generate the form in Rails, but we
also want to minimise the number of non-logged in people who have a
session cookie, so that varnish can cache pages extensively. So we don't
want to put the CSRF token for the search form in everyone's session.
Diffstat (limited to 'app')
| -rw-r--r-- | app/views/general/_frontpage_search_box.html.erb | 2 | ||||
| -rw-r--r-- | app/views/general/_header.html.erb | 2 | ||||
| -rw-r--r-- | app/views/general/_responsive_topnav.html.erb | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/app/views/general/_frontpage_search_box.html.erb b/app/views/general/_frontpage_search_box.html.erb index f77bd97fc..a58d837f8 100644 --- a/app/views/general/_frontpage_search_box.html.erb +++ b/app/views/general/_frontpage_search_box.html.erb @@ -5,7 +5,7 @@ :number_of_requests => number_with_delimiter(InfoRequest.visible.count), :number_of_authorities => number_with_delimiter(PublicBody.visible.count)) %> </h2> -<form id="search_form" method="post" action="<%= search_redirect_path %>"> +<form id="search_form" method="get" action="<%= search_redirect_path %>"> <div> <input id="query" type="text" size="30" name="query" title="type your search term here" > <input type="submit" value="<%= _('Search') %>"> diff --git a/app/views/general/_header.html.erb b/app/views/general/_header.html.erb index 55bf719e2..f465668a5 100644 --- a/app/views/general/_header.html.erb +++ b/app/views/general/_header.html.erb @@ -22,7 +22,7 @@ <% end %> <div id="navigation_search"> - <form id="navigation_search_form" method="post" action="<%= search_redirect_path %>"> + <form id="navigation_search_form" method="get" action="<%= search_redirect_path %>"> <p> <%= text_field_tag 'query', params[:query], { :size => 40, :id => "navigation_search_query", :title => "type your search term here" } %> <input id="navigation_search_button" type="submit" value="search"> diff --git a/app/views/general/_responsive_topnav.html.erb b/app/views/general/_responsive_topnav.html.erb index 0ece0da9a..0af6629c8 100644 --- a/app/views/general/_responsive_topnav.html.erb +++ b/app/views/general/_responsive_topnav.html.erb @@ -21,7 +21,7 @@ </li> <li id="navigation_search"> - <form id="navigation_search_form" method="post" action="<%= search_redirect_path %>"> + <form id="navigation_search_form" method="get" action="<%= search_redirect_path %>"> <label for="navigation_search_button"> <img src="/assets/search.png" alt="Search:"> </label> |