From cf3180f6b8c552bbf7214d1ba72fbf1fc90ef861 Mon Sep 17 00:00:00 2001
From: nicosomb <nicolas@loeuillet.org>
Date: Mon, 15 Apr 2013 14:09:58 +0200
Subject: =?UTF-8?q?v=C3=A9rificatio=20CSRF=20et=20mise=20en=20page?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tpl/home.html | 10 ++++++----
 tpl/view.html |  8 +++++---
 2 files changed, 11 insertions(+), 7 deletions(-)

(limited to 'tpl')

diff --git a/tpl/home.html b/tpl/home.html
index 70a35a7f..0de8007b 100644
--- a/tpl/home.html
+++ b/tpl/home.html
@@ -8,7 +8,7 @@
                 <li><a href="index.php" {if="$view == 'index'"}class="current"{/if}>home</a></li>
                 <li><a href="?view=fav" {if="$view == 'fav'"}class="current"{/if}>favorites</a></li>
                 <li><a href="?view=archive" {if="$view == 'archive'"}class="current"{/if}>archive</a></li>
-                <li><a style="cursor: move" title="i am a bookmarklet, use me !" href="javascript:(function(){var%20url%20=%20location.href;var%20title%20=%20document.title%20||%20url;window.open('{$poche_url}?action=add&url='%20+%20encodeURIComponent(url),'_self');})();">poche it !</a></li>
+                <li><a style="cursor: move" title="i am a bookmarklet, use me !" href="javascript:(function(){var%20url%20=%20location.href%20||%20url;window.open('{$poche_url}?action=add&url='%20+%20encodeURIComponent(url),'_self');})();">poche it !</a></li>
             </ul>
             <div id="content">
                 {loop="entries"}
@@ -18,9 +18,11 @@
                                 <a href="view.php?id={$value.id}">{$value.title}</a>
                             </h2>
                             <div class="tools">
-                                <a title="toggle mark as read" class="tool archive {if="$value.is_read == '0'"}archive-off{/if}" onclick="toggle_archive(this, {$value.id})"><span></span></a>
-                                <a title="toggle favorite" class="tool fav {if="$value.is_fav == '0'"}fav-off{/if}" onclick="toggle_favorite(this, {$value.id})"><span></span></a>
-                                <a href="?action=delete&id={$value.id}" title="toggle delete" onclick="return confirm('Are you sure?')" class="tool delete"><span></span></a>
+                                <ul>
+                                    <li><a title="toggle mark as read" class="tool archive {if="$value.is_read == '0'"}archive-off{/if}" onclick="toggle_archive(this, {$value.id}, '{$token}')"><span></span></a></li>
+                                    <li><a title="toggle favorite" class="tool fav {if="$value.is_fav == '0'"}fav-off{/if}" onclick="toggle_favorite(this, {$value.id}, '{$token}')"><span></span></a></li>
+                                    <li><form method="post" onsubmit="return confirm('Are you sure?')" style="display: inline;"><input type="hidden" name="token" id="token" value="{$token}" /><input type="hidden" id="action" name="action" value="delete" /><input type="hidden" id="id" name="id" value="{$value.id}" /><input type="submit" class="delete" title="toggle delete" /></form></li>
+                                </ul>
                             </div>
                         </span>
                     </div>
diff --git a/tpl/view.html b/tpl/view.html
index 1e057889..d24d26ed 100755
--- a/tpl/view.html
+++ b/tpl/view.html
@@ -5,9 +5,11 @@
         		<a href="index.php" title="back to home">&larr;</a>
         	</div>
             <div class="tools">
-                <a title="toggle mark as read" class="tool archive {if="$is_read == 0"}archive-off{/if}" onclick="toggle_archive(this, {$id}, 1)"><span></span></a>
-                <a title="toggle favorite" class="tool fav  {if="$is_fav == 0"}fav-off{/if}" onclick="toggle_favorite(this, {$id})"><span></span></a>
-                <a href="index.php?action=delete&id={$id}" title="toggle delete" onclick="return confirm('Are you sure?')" class="tool delete"><span></span></a>
+                <ul>
+                    <li><a title="toggle mark as read" class="tool archive {if="$is_read == '0'"}archive-off{/if}" onclick="toggle_archive(this, {$id}, '{$token}')"><span></span></a></li>
+                    <li><a title="toggle favorite" class="tool fav {if="$is_fav == '0'"}fav-off{/if}" onclick="toggle_favorite(this, {$id}, '{$token}')"><span></span></a></li>
+                    <li><form method="post" onsubmit="return confirm('Are you sure?')" style="display: inline;"><input type="hidden" name="token" id="token" value="{$token}" /><input type="hidden" id="action" name="action" value="delete" /><input type="hidden" id="id" name="id" value="{$id}" /><input type="submit" class="delete" title="toggle delete" /></form></li>
+                </ul>
             </div>
             <header class="mbm">
                 <h1><a href="{$url}">{$title}</a></h1>
-- 
cgit v1.2.3