SiteManagr - A simple open source CMS

[eluser]Dan King[/eluser]
[quote author="neillyons.info" date="1264656043"]Hi there,

When deleting always submit a form using the post method.

Let me explain why.

At the moment Sitemanagr deletes posts by passing the post id to the delete function of the posts controller. Like so:

Code:

http://example.com/admin/posts/delete/2

This will delete the post if you are logged in and have the right privileges.

But...

If your site accepts comments for example and a user submits that link as an image; like so:

Code:

<img src="http://example.com/admin/posts/delete/2" alt="This will delete your post."/>

Then when you yourself as the admin user come to browse through the comments on your site the browser will attempt to fetch that image by sending off a request to that URL. But because you are logged in whilst the browser is doing this the post will get deleted.

Hope that makes sense.[/quote]

Wow, yes that makes perfect sense. I see exactly what you mean, and I never would have thought of that. Thanks for pointing that out!