passwordauth: prevent authentication bypass via multiple name parameters

[git.ikiwiki.info.git] / templates / openid-selector.tmpl

diff --git a/templates/openid-selector.tmpl b/templates/openid-selector.tmpl
index 393479865f4a34c891e67099b7a0bd3d92e282e8..0fd833042db4d0e692873bfe4b8c5a9bf974a06d 100644 (file)
--- a/templates/openid-selector.tmpl
+++ b/templates/openid-selector.tmpl
@@ -1,25 +1,29 @@
-<script type="text/javascript" src="ikiwiki/openid/jquery.js"></script>
+<script type="text/javascript" src="ikiwiki/jquery.min.js"></script>
 <script type="text/javascript" src="ikiwiki/openid/openid-jquery.js"></script>
 <script type="text/javascript">
 $(document).ready(function() {
-       openid.init('openid_identifier');
+       openid.init('openid_identifier','<TMPL_IF NONOPENIDFORM>nonopenidform</TMPL_IF>');
 });
 </script>
-       
+
+<noscript>
+<h2>OpenID:</h2>
+</noscript>
+
 <form action="<TMPL_VAR CGIURL>" method="get" id="openid_form">
-       <input type="hidden" name="do" value="signin" />
-       <input type="hidden" name="action" value="verify" />
        <fieldset>
-               <legend><TMPL_VAR LOGINLABEL></legend>
+               <script>
+               $('fieldset').append("<legend>Select your account provider</legend>");
+               </script>
+               
+               <input type="hidden" name="do" value="signin" />
+               <input type="hidden" name="action" value="verify" />
                <div id="openid_choice">
-                       <div id="openid_btns">
-                       </div>
-                       <TMPL_IF NONOPENIDURL>
-                       <a href="<TMPL_VAR NONOPENIDURL>">local account</a>
-                       </TMPL_IF>
+                       <div id="openid_btns"></div>
                </div>
                <div id="openid_input_area">
-                       <input id="openid_identifier" name="openid_identifier" type="text" value="<TMPL_VAR OPENID_URL>"/>
+                       <label for="openid_identifier" class="block">Enter your OpenID:</label>
+                       <input id="openid_identifier" name="openid_identifier" type="text" value="<TMPL_VAR ESCAPE=HTML OPENID_URL>"/>
                        <input id="openid_submit" type="submit" value="Login"/>
                </div>
                <TMPL_IF OPENID_ERROR>
@@ -27,3 +31,13 @@ $(document).ready(function() {
                </TMPL_IF>
        </fieldset>
 </form>
+
+<div id="nonopenidform">
+<TMPL_IF NONOPENIDFORM>
+<br />
+<noscript>
+<h2>Other:</h2>
+</noscript>
+</TMPL_IF>
+<TMPL_VAR NONOPENIDFORM>
+</div>