-
-
Notifications
You must be signed in to change notification settings - Fork 6.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
yii2-app-advanced - unnesessary meta tags in passwordResetToken html email #3358
Comments
I managed to fix this by adding
to \advanced\common\mail\passwordResetToken.php But I am not sure - maybe it should be done on the level of yii\web\View ? |
csrf for not Get requests. Reset link is Get |
@lynicidn The issue is that when rendering email html layout,
in email html layout. |
Yes, it does that. Will fix it but since it doesn't cause any trouble it's low priority. |
The valid fix for this will be removal direct coupling between
|
👍 |
Crap, it seems I can not avoid instantiating of the 'view' component: there is no way to append event handler via config in safe way.
However if there is already a key 'on beginPage' in the 'view' config, there is no proper way to keep it. |
Yet another option will be just placing following code at the top of the layout file:
But in this case it would not be automatic and developer will be responsible for it, so BC will be broken. |
…ew`. Added `Html::csrfMetaTags()` and its call to main layout files
When email with password reset token is sent - csrf meta tags are included in head section of email html message:
That makes no sense since they are not used to validate anything - password reset link can be used standalone by simple copying it to browser address bar.
The text was updated successfully, but these errors were encountered: