Prevent CSRF bypass with login form

[rails.git] / app / views / users / login.html.erb

diff --git a/app/views/users/login.html.erb b/app/views/users/login.html.erb
index 78ba25fa4139ac5f47458c4464b75279188a4039..947aafbf931d073b5397f3b40a9eb1b33f4a3909 100644 (file)
--- a/app/views/users/login.html.erb
+++ b/app/views/users/login.html.erb
@@ -21,48 +21,44 @@
     <%= f.primary t(".login_button"), :tabindex => 4 %>
   <% end %>
 
-  <%= form_tag(auth_path(:provider => "openid"), :id => "openid_login_form") do %>
-    <div id="loginForm" class="standard-form">
+  <hr>
 
-      <fieldset class='form-divider'>
+  <div id="loginForm">
+    <div class="form-group">
+      <label><%= t ".with external" %></label>
 
-        <p class='standard-label'><%= t ".with external" %></p>
+      <ul class='list-unstyled' id="login_auth_buttons">
+        <li><%= link_to image_tag("openid.png", :alt => t(".auth_providers.openid.title")), "#", :id => "openid_open_url", :title => t(".auth_providers.openid.title") %></li>
+        <% if Settings.key?(:google_auth_id) -%>
+        <li><%= auth_button "google", "google" %></li>
+        <% end -%>
+        <% if Settings.key?(:facebook_auth_id) -%>
+        <li><%= auth_button "facebook", "facebook" %></li>
+        <% end -%>
+        <% if Settings.key?(:windowslive_auth_id) -%>
+        <li><%= auth_button "windowslive", "windowslive" %></li>
+        <% end -%>
+        <% if Settings.key?(:github_auth_id) -%>
+        <li><%= auth_button "github", "github" %></li>
+        <% end -%>
+        <% if Settings.key?(:wikipedia_auth_id) -%>
+        <li><%= auth_button "wikipedia", "wikipedia" %></li>
+        <% end -%>
+        <li><%= auth_button "yahoo", "openid", :openid_url => "yahoo.com" %></li>
+        <li><%= auth_button "wordpress", "openid", :openid_url => "wordpress.com" %></li>
+        <li><%= auth_button "aol", "openid", :openid_url => "aol.com" %></li>
+      </ul>
 
-        <ul class='list-unstyled' id="login_auth_buttons">
-          <li><%= link_to image_tag("openid.png", :alt => t(".auth_providers.openid.title")), "#", :id => "openid_open_url", :title => t(".auth_providers.openid.title") %></li>
-          <% if Settings.key?(:google_auth_id) -%>
-          <li><%= auth_button "google", "google" %></li>
-          <% end -%>
-          <% if Settings.key?(:facebook_auth_id) -%>
-          <li><%= auth_button "facebook", "facebook" %></li>
-          <% end -%>
-          <% if Settings.key?(:windowslive_auth_id) -%>
-          <li><%= auth_button "windowslive", "windowslive" %></li>
-          <% end -%>
-          <% if Settings.key?(:github_auth_id) -%>
-          <li><%= auth_button "github", "github" %></li>
-          <% end -%>
-          <% if Settings.key?(:wikipedia_auth_id) -%>
-          <li><%= auth_button "wikipedia", "wikipedia" %></li>
-          <% end -%>
-          <li><%= auth_button "yahoo", "openid", :openid_url => "yahoo.com" %></li>
-          <li><%= auth_button "wordpress", "openid", :openid_url => "wordpress.com" %></li>
-          <li><%= auth_button "aol", "openid", :openid_url => "aol.com" %></li>
-        </ul>
-
-        <div id='login_openid_url' class='standard-form-row'>
-          <label for='openid_url' class="standard-label"><%= t ".openid_html", :logo => openid_logo %></label>
-          <%= hidden_field_tag("openid_referer", params[:referer]) if params[:referer] %>
-          <%= text_field_tag("openid_url", "", :tabindex => 3, :class => "openid_url") %>
-          <span class="minorNote">(<a href="<%= t "users.account.openid.link" %>" target="_new"><%= t "users.account.openid.link text" %></a>)</span>
+      <%= form_tag(auth_path(:provider => "openid"), :id => "openid_login_form") do %>
+        <div id='login_openid_url' class="form-group">
+          <label for='openid_url'><%= t ".openid_html", :logo => openid_logo %></label>
+          <%= hidden_field_tag("referer", params[:referer]) %>
+          <%= text_field_tag("openid_url", "", :tabindex => 3, :class => "openid_url form-control") %>
+          <span class="form-text text-muted">(<a href="<%= t "users.account.openid.link" %>" target="_new"><%= t "users.account.openid.link text" %></a>)</span>
         </div>
 
-        <%= submit_tag t(".login_button"), :tabindex => 6, :id => "login_openid_submit" %>
-
-      </fieldset>
-
+        <%= submit_tag t(".login_button"), :tabindex => 6, :id => "login_openid_submit", :class => "btn btn-primary" %>
+      <% end %>
     </div>
-
-  <% end %>
-
+  </div>
 </div>