mark_story f23d811ff5 Use the form action URL in generated form hashes. ... By including the URL in generated hash for secured forms we prevent a class of abuse where a user uses one secured form to post into a controller action the form was not originally intended for. These cross action requests could potentially violate developer's mental model of how SecurityComponent works and produce unexpected/undesirable outcomes. Thanks to Kurita Takashi for pointing this issue out, and suggesting a fix.		2014-04-25 22:05:58 -04:00
..
Component	Use the form action URL in generated form hashes.	2014-04-25 22:05:58 -04:00
CakeErrorController.php	Removed "PHP 5" from file header DocBlocks	2013-11-13 22:58:39 +01:00
Component.php	Removed "PHP 5" from file header DocBlocks	2013-11-13 22:58:39 +01:00
ComponentCollection.php	remove undocumented code and uncessary in_array() checks + cleanup	2013-08-08 03:56:58 +02:00
Controller.php	correct deprecation notices	2014-04-04 19:18:02 +02:00
Scaffold.php	Removed "PHP 5" from file header DocBlocks	2013-11-13 22:58:39 +01:00