From 6d46dc26c7ec281771ae4be01b9d9ba88143186d Mon Sep 17 00:00:00 2001
From: Chris Raible <chris@ghost.org>
Date: Wed, 21 Aug 2024 15:49:52 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fixed=20admin=20forms=20defaulti?=
 =?UTF-8?q?ng=20to=20GET=20method=20(#20810)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ref
https://linear.app/tryghost/issue/ENG-1497/admin-signin-signup-and-setup-forms-default-to-get

- If method is not specified, the form will default to GET, which is
incorrect
- This commit sets the method to POST and action to javascript:void(0)
to prevent the form from submitting via GET if JavaScript is disabled or
not fully loaded yet
---
 ghost/admin/app/templates/setup.hbs  | 2 +-
 ghost/admin/app/templates/signin.hbs | 2 +-
 ghost/admin/app/templates/signup.hbs | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ghost/admin/app/templates/setup.hbs b/ghost/admin/app/templates/setup.hbs
index 5110340e81..db40583602 100644
--- a/ghost/admin/app/templates/setup.hbs
+++ b/ghost/admin/app/templates/setup.hbs
@@ -6,7 +6,7 @@
             <p>All over the world, people have started 3,000,000+ incredible sites with Ghost. Today, we’re starting yours.</p>
         </header>
 
-        <form id="setup" class="gh-flow-form">
+        <form id="setup" method="post" action="javascript:void(0)" class="gh-flow-form">
             <GhFormGroup @errors={{this.errors}} @hasValidated={{this.hasValidated}} @property="blogTitle">
                 <label for="blog-title">Site title</label>
                 <span class="gh-input-icon gh-icon-content">
diff --git a/ghost/admin/app/templates/signin.hbs b/ghost/admin/app/templates/signin.hbs
index fdaffa1e9d..2a3d5e2741 100644
--- a/ghost/admin/app/templates/signin.hbs
+++ b/ghost/admin/app/templates/signin.hbs
@@ -12,7 +12,7 @@
                     </header>
                 </div>
             {{else}}
-                <form id="login" class="gh-signin" novalidate="novalidate" {{on "submit" (perform this.validateAndAuthenticateTask)}}>
+                <form id="login" method="post" action="javascript:void(0)" class="gh-signin" novalidate="novalidate" {{on "submit" (perform this.validateAndAuthenticateTask)}}>
                     <header>
                         <div class="gh-site-icon" style={{site-icon-style}}></div>
                         <h1>{{this.config.blogTitle}}</h1>
diff --git a/ghost/admin/app/templates/signup.hbs b/ghost/admin/app/templates/signup.hbs
index 252ad4a758..c6996c8922 100644
--- a/ghost/admin/app/templates/signup.hbs
+++ b/ghost/admin/app/templates/signup.hbs
@@ -7,7 +7,7 @@
                 <h1>Create your account.</h1>
             </header>
 
-            <form id="signup" class="gh-signup" novalidate="novalidate" {{on "submit" this.submit}}>
+            <form id="signup" method="post" action="javascript:void(0)" class="gh-signup" novalidate="novalidate" {{on "submit" this.submit}}>
                 <GhFormGroup @errors={{this.signupDetails.errors}} @hasValidated={{this.signupDetails.hasValidated}} @property="name">
                     <label for="name">Full name</label>
                     <span class="gh-input-icon gh-icon-user">