Commits on Aug 1, 2021

1. Disable Form Tampering Protection for comment forms (fixes Tatoeba#1809) …

   CakePHP's FormHelper [uses a SHA1 HMAC signature](https://api.cakephp.org/3.8/source-class-Cake.View.Helper.SecureFieldTokenTrait.html#61)
   to protect hidden fields against modification by malicious users.
   The signature also covers the session_id, which means that if the
   session_id changes, all previously loaded forms break.
   
   For the comment forms, the only hidden field is the sentence_id. Being
   able to modify it doesn't grant malicious users any interesting
   capabilities. If they want to post a comment on a different sentence,
   they can already do that.

   

   Yorwba committed Aug 1, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for a2faf35
   • Browse repository at this point

   Copy the full SHA

   a2faf35 View commit details

   Browse the repository at this point in the history