From 074f6c104f3e49401ef0065540338fc2d4be79f0 Mon Sep 17 00:00:00 2001
From: Frederic Guillot <fred@kanboard.net>
Date: Sat, 23 Sep 2017 18:48:45 -0700
Subject: Avoid people to alter other projects by changing form data

---
 app/Template/column/create.php | 2 --
 app/Template/column/edit.php   | 3 ---
 2 files changed, 5 deletions(-)

(limited to 'app/Template/column')

diff --git a/app/Template/column/create.php b/app/Template/column/create.php
index aad9606b..2b0c4641 100644
--- a/app/Template/column/create.php
+++ b/app/Template/column/create.php
@@ -4,8 +4,6 @@
 <form method="post" action="<?= $this->url->href('ColumnController', 'save', array('project_id' => $project['id'])) ?>" autocomplete="off">
     <?= $this->form->csrf() ?>
 
-    <?= $this->form->hidden('project_id', $values) ?>
-
     <?= $this->form->label(t('Title'), 'title') ?>
     <?= $this->form->text('title', $values, $errors, array('autofocus', 'required', 'maxlength="50"', 'tabindex="1"')) ?>
 
diff --git a/app/Template/column/edit.php b/app/Template/column/edit.php
index e590b5cc..25cf60c9 100644
--- a/app/Template/column/edit.php
+++ b/app/Template/column/edit.php
@@ -5,9 +5,6 @@
 <form method="post" action="<?= $this->url->href('ColumnController', 'update', array('project_id' => $project['id'], 'column_id' => $column['id'])) ?>" autocomplete="off">
     <?= $this->form->csrf() ?>
 
-    <?= $this->form->hidden('id', $values) ?>
-    <?= $this->form->hidden('project_id', $values) ?>
-
     <?= $this->form->label(t('Title'), 'title') ?>
     <?= $this->form->text('title', $values, $errors, array('autofocus', 'required', 'maxlength="50"')) ?>
 
-- 
cgit v1.2.3