Re: How to prevent Cross Site Foreign Script Attacks on your actions.

2009-11-03 Thread Miles J
You dont. You turn it into a button or submit form, then post the data to the action and then do the processing. Or you do an AJAX call. On Nov 3, 5:08 am, "j0n4s.h4rtm...@googlemail.com" wrote: > I don't entirely understand. How could I fill up $_POSTS by using > $html->link? > > On Nov 3, 12:3

Re: How to prevent Cross Site Foreign Script Attacks on your actions.

2009-11-03 Thread John Andersen
Look at the documentation at CakePHP http://book.cakephp.org/view/55/The-Parameters-Attribute-params This will describe where CakePHP stores the form data and the URL data. Enjoy, John On Nov 2, 6:44 pm, Jonas Hartmann wrote: > Given someone mails you a link with html images that tries to

Re: How to prevent Cross Site Foreign Script Attacks on your actions.

2009-11-03 Thread j0n4s.h4rtm...@googlemail.com
I don't entirely understand. How could I fill up $_POSTS by using $html->link? On Nov 3, 12:32 am, Miles J wrote: > Well in most cases then not, if your on, says a users profile, you > would submit to that page. Within that page you would check if a > $_POST exists and then perform the add frien

Re: How to prevent Cross Site Foreign Script Attacks on your actions.

2009-11-02 Thread Miles J
Well in most cases then not, if your on, says a users profile, you would submit to that page. Within that page you would check if a $_POST exists and then perform the add friend logic. On Nov 2, 8:44 am, Jonas Hartmann wrote: > Given someone mails you a link with html images that tries to > fet

How to prevent Cross Site Foreign Script Attacks on your actions.

2009-11-02 Thread Jonas Hartmann
Given someone mails you a link with html images that tries to fetch http://domain.tld/users/add_friend/5 - now the user is logged into a web client that fetches that URL. How do you protect your cake application to not modify data. HTML wise this should be a PUT or POST method not a GET met