Upgrade to 4.0.8 with modification of ExternalAuth.

[usit-rt.git] / share / html / Search / Results.html

diff --git a/share/html/Search/Results.html b/share/html/Search/Results.html
index 171b38d92b09bf7c6ce42955aeb5e07cf30799ab..4fee865067daef3a9c72d56589a5276d61557beb 100644 (file)
--- a/share/html/Search/Results.html
+++ b/share/html/Search/Results.html
@@ -151,6 +151,7 @@ if ($ARGS{'TicketsRefreshInterval'}) {
 my $refresh = $session{'tickets_refresh_interval'}
     || RT->Config->Get('SearchResultsRefreshInterval', $session{'CurrentUser'} );
 
+# Check $m->request_args, not $DECODED_ARGS, to avoid creating a new CSRF token on each refresh
 if (RT->Config->Get('RestrictReferrer') and $refresh and not $m->request_args->{CSRF_Token}) {
     my $token = RT::Interface::Web::StoreRequestToken( $session{'CurrentSearchHash'} );
     $m->notes->{RefreshURL} = RT->Config->Get('WebURL')