yesod-core 1.6.14 → 1.6.15

raw patch · 3 files changed

+9/−2 lines, 3 files

Files

ChangeLog.md +5/−0
src/Yesod/Core/Handler.hs +3/−1
yesod-core.cabal +1/−1

ChangeLog.md view

@@ -1,5 +1,10 @@ # ChangeLog for yesod-core +## 1.6.15++* Move `redirectToPost` JavaScript form submission from HTML element to+  `<script>` tag for CSP reasons [#1620](https://github.com/yesodweb/yesod/pull/1620)+ ## 1.6.14  * Introduce `JSONResponse`. [issue #1481](https://github.com/yesodweb/yesod/issues/1481) and [PR #1592](https://github.com/yesodweb/yesod/pull/1592)

src/Yesod/Core/Handler.hs view

@@ -1069,13 +1069,15 @@ <html>     <head>         <title>Redirecting...-    <body onload="document.getElementById('form').submit()">+    <body>         <form id="form" method="post" action=#{urlText}>             $maybe token <- reqToken req                 <input type=hidden name=#{defaultCsrfParamName} value=#{token}>             <noscript>                 <p>Javascript has been disabled; please click on the button below to be redirected.             <input type="submit" value="Continue">+        <script>+          window.onload = function() { document.getElementById('form').submit(); }; |] >>= sendResponse  -- | Wraps the 'Content' generated by 'hamletToContent' in a 'RepHtml'.

yesod-core.cabal view

@@ -1,5 +1,5 @@ name:            yesod-core-version:         1.6.14+version:         1.6.15 license:         MIT license-file:    LICENSE author:          Michael Snoyman <michael@snoyman.com>