search

rmrevin / yii2-comments

Yii 2 comments extension
MIT License
52 stars 19 forks source link

Delete link should be send by post? #7

Closed Patroklo closed 8 years ago

Patroklo commented 8 years ago

At least it should be interesting to add more security there, because it's very simple to make a fake link and make people click it to start deleting their own posts without knowing. Yii2 usually add a post link to prevent this kind of behavior (for example the logout link).

rmrevin commented 8 years ago

In this case, you must check csrf token. It is the task of the client code, not this extension.