Skip to content

Add a CSRF token in the calculator form. Avoid printing an unescaped error (which may contain JS).

Philip Elson requested to merge pelson/cara:security/review into master

Further to the security audit, two very easy wins:

  • Include a CSRF token
  • Escape the error message when invalid input submitted

closes #131 (closed)

Edited by Andre Henriques

Merge request reports