discourse/app/views/users/omniauth_callbacks/confirm_request.html.erb

<div id='simple-container'>
  <h2><%= t('login.omniauth_confirm_title', provider:(t "js.login.#{params[:provider]}.name", default: params[:provider])) %></h2>
  <br/>

  <form method="post">
    <%= hidden_field_tag :authenticity_token, form_authenticity_token %>
    <%= button_tag(type: "submit", class: "btn btn-primary") do %>
        <%= SvgSprite.raw_svg('fa-plug') %><%= t 'login.omniauth_confirm_button' %>
    <% end %>
  </form>
</div>
SECURITY: Require POST with CSRF token for OmniAuth request phase 2019-08-08 18:57:28 +08:00			`<div id='simple-container'>`
UX: Fallback to unlocalized auth provider name if required 2019-08-13 08:22:02 +08:00			`<h2><%= t('login.omniauth_confirm_title', provider:(t "js.login.#{params[:provider]}.name", default: params[:provider])) %></h2>`
SECURITY: Require POST with CSRF token for OmniAuth request phase 2019-08-08 18:57:28 +08:00			`<br/>`

FIX: Allow omniauth confirmation page to pass through GET parameters Using the rails `form_tag` helper generates a form with the action attribute set to the current URL (without parameters). In this case, we want to include any GET parameters, so it is better to exclude the action attribute from the form tag, and allow browsers to submit to the current URL. 2020-01-08 23:31:51 +08:00			`<form method="post">`
			`<%= hidden_field_tag :authenticity_token, form_authenticity_token %>`
SECURITY: Require POST with CSRF token for OmniAuth request phase 2019-08-08 18:57:28 +08:00			`<%= button_tag(type: "submit", class: "btn btn-primary") do %>`
			`<%= SvgSprite.raw_svg('fa-plug') %><%= t 'login.omniauth_confirm_button' %>`
			`<% end %>`
FIX: Allow omniauth confirmation page to pass through GET parameters Using the rails `form_tag` helper generates a form with the action attribute set to the current URL (without parameters). In this case, we want to include any GET parameters, so it is better to exclude the action attribute from the form tag, and allow browsers to submit to the current URL. 2020-01-08 23:31:51 +08:00			`</form>`
SECURITY: Require POST with CSRF token for OmniAuth request phase 2019-08-08 18:57:28 +08:00			`</div>`