From 296faa546fbb52c96f68a927832afe401fea8376 Mon Sep 17 00:00:00 2001
From: Anthony Mangano <amangano@edx.org>
Date: Tue, 6 Dec 2016 17:30:05 -0500
Subject: [PATCH] Add method attribute to make sure login, registration,
 password_reset, and financial_assistance forms are always submitted via POST.
 SEC-223

---
 .../financial-assistance/financial_assessment_form.underscore   | 2 +-
 lms/templates/student_account/login.underscore                  | 2 +-
 lms/templates/student_account/password_reset.underscore         | 2 +-
 lms/templates/student_account/register.underscore               | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lms/templates/financial-assistance/financial_assessment_form.underscore b/lms/templates/financial-assistance/financial_assessment_form.underscore
index 7d1b39dbe5..ee970977bf 100644
--- a/lms/templates/financial-assistance/financial_assessment_form.underscore
+++ b/lms/templates/financial-assistance/financial_assessment_form.underscore
@@ -6,7 +6,7 @@
   <%  }); %>
 </div>
 
-<form class="financial-assistance-form">
+<form class="financial-assistance-form" method="POST">
 	<div class="status submission-error hidden" aria-live="polite">
 	    <h4 class="message-title"><%- gettext('Unable to submit application') %></h4>
 	    <ul class="message-copy"></ul>
diff --git a/lms/templates/student_account/login.underscore b/lms/templates/student_account/login.underscore
index 66f8123230..3bfa724d9e 100644
--- a/lms/templates/student_account/login.underscore
+++ b/lms/templates/student_account/login.underscore
@@ -26,7 +26,7 @@
     </div>
 <% } %>
 
-<form id="login" class="login-form" tabindex="-1">
+<form id="login" class="login-form" tabindex="-1" method="POST">
 
     <div class="section-title lines">
         <h2>
diff --git a/lms/templates/student_account/password_reset.underscore b/lms/templates/student_account/password_reset.underscore
index bbb20b1143..a970266603 100644
--- a/lms/templates/student_account/password_reset.underscore
+++ b/lms/templates/student_account/password_reset.underscore
@@ -3,7 +3,7 @@
     <ul class="message-copy"></ul>
 </div>
 
-<form id="password-reset" class="password-reset-form" tabindex="-1">
+<form id="password-reset" class="password-reset-form" tabindex="-1" method="POST">
 
     <div class="section-title lines">
         <h2>
diff --git a/lms/templates/student_account/register.underscore b/lms/templates/student_account/register.underscore
index bbcb7f12cd..c323b70ae9 100644
--- a/lms/templates/student_account/register.underscore
+++ b/lms/templates/student_account/register.underscore
@@ -3,7 +3,7 @@
     <ul class="message-copy"></ul>
 </div>
 
-<form id="register" class="register-form" autocomplete="off" tabindex="-1">
+<form id="register" class="register-form" autocomplete="off" tabindex="-1" method="POST">
 
     <% if (context.errorMessage) { %>
         <div class="status submission-error">