From 50f88df47f6d5b3cb5dc20fb2e9d3022862adbcf Mon Sep 17 00:00:00 2001
From: Dan Untenzu <untenzu@webit.de>
Date: Wed, 18 Jan 2017 19:00:44 +0100
Subject: [PATCH 1/1] [FEATURE] Installer: Remove (unknown) form target URL
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

The domain on which Jirafeau is running, is not yet
defined while installing the project. In order to build valid
action links for the form, the script generated a possible URL
using the request header. This method may fail for proxies
or while using HTTPS or due to spoofing or…

In HTML5 we can safely omnit the action attribute (see
http://stackoverflow.com/a/9678030), which will cause the browser
to send the request to the exact same URL again.

This way we can avoid the URL guessing during the installation.

Refs #79
---
 install.php | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/install.php b/install.php
index 2d7afd9..fbd3667 100644
--- a/install.php
+++ b/install.php
@@ -206,8 +206,7 @@ case 1:
 default:
     ?><h2><?php printf (t('Installation of Jirafeau') . ' - ' . t('step') .
     ' %d ' . t('out of') . ' %d', 1, 4);
-    ?></h2> <div id = "install"> <form action =
-        "<?php echo basename(__FILE__); ?>" method = "post"> <input type =
+    ?></h2> <div id = "install"> <form method="post"> <input type =
         "hidden" name = "jirafeau" value =
         "<?php echo JIRAFEAU_VERSION; ?>" /><input type = "hidden" name =
         "step" value = "1" /><fieldset> <legend><?php echo t('Language');
@@ -240,8 +239,7 @@ break;
 case 2:
     ?><h2><?php printf (t('Installation of Jirafeau') . ' - ' . t('step') .
     ' %d ' . t('out of') . ' %d', 2, 4);
-    ?></h2> <div id = "install"> <form action =
-        "<?php echo basename(__FILE__); ?>" method = "post"> <input type =
+    ?></h2> <div id = "install"> <form method="post"> <input type =
         "hidden" name = "jirafeau" value =
         "<?php echo JIRAFEAU_VERSION; ?>" /><input type = "hidden" name =
         "step" value = "2" /><fieldset> <legend><?php
@@ -272,8 +270,7 @@ break;
 case 3:
     ?><h2><?php printf (t('Installation of Jirafeau') . ' - ' . t('step') .
     ' %d ' . t('out of') . ' %d', 3, 4);
-    ?></h2> <div id = "install"> <form action =
-        "<?php echo basename(__FILE__); ?>" method = "post"> <input type =
+    ?></h2> <div id = "install"> <form method="post"> <input type =
         "hidden" name = "jirafeau" value =
         "<?php echo JIRAFEAU_VERSION; ?>" /><input type = "hidden" name =
         "step" value =
@@ -328,8 +325,7 @@ break;
 case 4:
     ?><h2><?php printf (t('Installation of Jirafeau') . ' - ' . t('step') .
     ' %d ' . t('out of') . ' %d', 4, 4);
-    ?></h2> <div id = "install"> <form action =
-        "<?php echo basename(__FILE__); ?>" method = "post"> <input type =
+    ?></h2> <div id = "install"> <form method="post"> <input type =
         "hidden" name = "jirafeau" value =
         "<?php echo JIRAFEAU_VERSION; ?>" /><input type = "hidden" name =
         "step" value =
@@ -350,8 +346,7 @@ case 4:
     if ($err['has_error'])
     {
         echo '<div class="error"><p>'.$err['why'].'<br />'.NL;
-        ?><form action = "<?php echo basename(__FILE__); ?>" method =
-            "post"> <input type = "hidden" name = "jirafeau" value =
+        ?><form method="post"> <input type = "hidden" name = "jirafeau" value =
             "<?php echo JIRAFEAU_VERSION; ?>" /><input type = "hidden" name =
             "step" value = "4" /><input type = "submit" name =
             "retry" value =
-- 
2.34.1