mark_story f23d811ff5 Use the form action URL in generated form hashes. ... By including the URL in generated hash for secured forms we prevent a class of abuse where a user uses one secured form to post into a controller action the form was not originally intended for. These cross action requests could potentially violate developer's mental model of how SecurityComponent works and produce unexpected/undesirable outcomes. Thanks to Kurita Takashi for pointing this issue out, and suggesting a fix.		2014-04-25 22:05:58 -04:00
..
Cake	Use the form action URL in generated form hashes.	2014-04-25 22:05:58 -04:00