external/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2024-11-13 02:14:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

HTML: Replace hidden 'action' input with query parameter

Browse source 
The server side can only handle parameters passed as URL query
parameters and not inside the request body
This commit is contained in:
Samantaz Fox 2024-10-29 22:14:20 +01:00
parent dbdf2ad23a
commit b0c7dd9771
No known key found for this signature in database
GPG key ID: F42821059186176E
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/invidious/views/watch.ecr
View file

@ -158,7 +158,7 @@ we're going to need to do it here in order to allow for translations.
<% if user %>
<% playlists = Invidious::Database::Playlists.select_user_created_playlists(user.email) %>
<% if !playlists.empty? %>
<form data-onsubmit="return_false" class="pure-form pure-form-stacked" action="/playlist_ajax" method="post" target="_blank">
<form data-onsubmit="return_false" class="pure-form pure-form-stacked" action="/playlist_ajax?action=add_video" method="post" target="_blank">
<div class="pure-control-group">
<label for="playlist_id"><%= translate(locale, "Add to playlist: ") %></label>
<select style="width:100%" name="playlist_id" id="playlist_id">
@ -169,7 +169,6 @@ we're going to need to do it here in order to allow for translations.
</div>
<input type="hidden" name="csrf_token" value="<%= URI.encode_www_form(env.get?("csrf_token").try &.as(String) || "") %>">
<input type="hidden" name="action" value="add_video">
<input type="hidden" name="video_id" value="<%= video.id %>">
<button data-onclick="add_playlist_video" data-id="<%= video.id %>" type="submit" class="pure-button pure-button-primary">
<b><%= translate(locale, "Add to playlist") %></b>