From b6ab18b311f5e733eae41b94fa9817e9cbfa6f53 Mon Sep 17 00:00:00 2001
From: Roeland Jago Douma <roeland@famdouma.nl>
Date: Mon, 11 May 2020 21:18:38 +0200
Subject: Move the password confirmation form template to post

I know we use JS for this. But it triggers some false positives on
testing.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
---
 core/templates/layout.user.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'core')

diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index 7712992c9bf..025c331aeaa 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -152,7 +152,7 @@
 		</header>
 
 		<div id="sudo-login-background" class="hidden"></div>
-		<form id="sudo-login-form" class="hidden">
+		<form id="sudo-login-form" class="hidden" method="POST">
 			<label>
 				<?php p($l->t('This action requires you to confirm your password')); ?><br/>
 				<input type="password" class="question" autocomplete="new-password" name="question" value=" <?php /* Hack against browsers ignoring autocomplete="off" */ ?>"
-- 
cgit v1.2.3