luci-mod-admin-full: protect network post actions with csrf tokens

[project/luci.git] / modules / luci-mod-admin-full / luasrc / view / admin_network / wifi_join.htm

diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_network/wifi_join.htm b/modules/luci-mod-admin-full/luasrc/view/admin_network/wifi_join.htm
index f3b6ddd..3533c6f 100644 (file)
--- a/modules/luci-mod-admin-full/luasrc/view/admin_network/wifi_join.htm
+++ b/modules/luci-mod-admin-full/luasrc/view/admin_network/wifi_join.htm
@@ -1,15 +1,6 @@
 <%#
-LuCI - Lua Configuration Interface
-Copyright 2009 Jo-Philipp Wich <xm@subsignal.org>
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-$Id$
-
+ Copyright 2009-2015 Jo-Philipp Wich <jow@openwrt.org>
+ Licensed to the public under the Apache License 2.0.
 -%>
 
 <%-
@@ -96,7 +87,7 @@ $Id$
 
 <%+header%>
 
-<h2><a id="content" name="content"><%:Join Network: Wireless Scan%></a></h2>
+<h2 name="content"><%:Join Network: Wireless Scan%></h2>
 
 <div class="cbi-map">
        <fieldset class="cbi-section">
@@ -118,7 +109,8 @@ $Id$
                                        <strong>Encryption:</strong> <%=format_wifi_encryption(net.encryption)%>
                                </td>
                                <td class="cbi-value-field" style="width:40px">
-                                       <form action="<%=REQUEST_URI%>" method="post">
+                                       <form action="<%=url('admin/network/wireless_join')%>" method="post">
+                                               <input type="hidden" name="token" value="<%=token%>" />
                                                <input type="hidden" name="device" value="<%=utl.pcdata(dev)%>" />
                                                <input type="hidden" name="join" value="<%=utl.pcdata(net.ssid)%>" />
                                                <input type="hidden" name="mode" value="<%=net.mode%>" />
@@ -144,10 +136,11 @@ $Id$
        </fieldset>
 </div>
 <div class="cbi-page-actions right">
-       <form class="inline" action="<%=luci.dispatcher.build_url("admin/network/wireless")%>" method="get">
+       <form class="inline" action="<%=url("admin/network/wireless")%>" method="get">
                <input class="cbi-button cbi-button-reset" type="submit" value="<%:Back to overview%>" />
        </form>
-       <form class="inline" action="<%=REQUEST_URI%>" method="get">
+       <form class="inline" action="<%=url('admin/network/wireless_join')%>" method="post">
+               <input type="hidden" name="token" value="<%=token%>" />
                <input type="hidden" name="device" value="<%=utl.pcdata(dev)%>" />
                <input class="cbi-button cbi-input-find" type="submit" value="<%:Repeat scan%>" />
        </form>