Never use the value attribute of <button> to encode anything we care

[disorder] / templates / login.html

diff --git a/templates/login.html b/templates/login.html
index ab943f9888d607462ae3b9e03b61098575bdee6e..21c7ddf05e947970591fb087258495005af06354 100644 (file)
--- a/templates/login.html
+++ b/templates/login.html
@@ -29,12 +29,16 @@ USA
 
    @if{@ne{@label:error@}{error}@}{
    @#{error reporting from some earlier operation}@
-   <p class=error>@label{error.@label:error@}@</p>
+   <div class=error>
+     <p class=error>@label{error.@label:error@}@</p>
+   </div>
    }@
 
    @if{@ne{@label:status@}{status}@}{
    @#{some action succeeded}@
-   <p class=loginstatus>@label{login.@label:status@}@</p>
+   <div class=loginstatus>
+     <p class=loginstatus>@label{login.@label:status@}@</p>
+   </div>
    }@
 
    @if{@eq{@user@}{guest}@}{
@@ -62,12 +66,13 @@ USA
        </tr>
        <tr>
          <td>
-           <button class=login name=action type=submit value=login>
+           <button class=login name=button type=submit>
              @label:login.login@
            </button>
          </td>
        </tr>
      </table>
+     <input name=action type=hidden value=login>
      <input name=nonce type=hidden value="@nonce@">
      <input name=back type=hidden value="@arg:back@">
    </form>
@@ -117,12 +122,13 @@ USA
        </tr>
        <tr>
          <td>
-           <button class=register name=action type=submit value=register>
+           <button class=register name=button>
              @label:login.register@
            </button>
          </td>
        </tr>
      </table>
+     <input name=action type=hidden value=register>
      <input name=nonce type=hidden value="@nonce@">
    </form>}@
    }{
@@ -133,10 +139,11 @@ USA
    <form class=logout action="@url@" method=POST
          enctype="multipart/form-data" accept-charset=utf-8>
      <div class=logout>
-       <button class=logout name=action type=submit value=logout>
+       <button class=logout name=submit type=submit>
          @label:login.logout@
        </button>
      </div>
+     <input name=action type=hidden value=logout>
      <input name=nonce type=hidden value="@nonce@">
    </form>
 
@@ -171,12 +178,13 @@ USA
        </tr>
        <tr>
          <td>
-           <button class=edituser name=action type=submit value=edituser>
+           <button class=edituser name=submit type=submit>
              @label:login.edituser@
            </button>
          </td>
        </tr>
      </table>
+     <input name=action type=hidden value=edituser>
      <input name=nonce type=hidden value="@nonce@">
    </form>