ikhattab

I know you protected forms from CSRF as you are already using CI 2 but what about actions links which depends on GET

links like 'site_name/users/logout' or even worse 'site_name/admin/news/categories/delete/1'

what if user is logged in and visits a malicious link sent by attacker for page contains something like

<img src="site_name/admin/news/categories/delete/1" /> as user is already logged in there will
be no problem and he'll have his category with id "1" deleted

I think we shouldn't rely on GET for actions. GET is only for displaying data

ikhattab

/*
 * HTML5 Boilerplate
 *
 * What follows is the result of much research on cross-browser styling.
 * Credit left inline and big thanks to Nicolas Gallagher, Jonathan Neal,
 * Kroc Camen, and the H5BP dev community and team.
 *
 * Detailed information about this CSS: h5bp.com/css
 *
 * ==|== normalize ==========================================================

ikhattab

@-webkit-keyframes NAME-YOUR-ANIMATION {
	0%   { opacity: 0; }
	100% { opacity: 1; }
}
@-moz-keyframes NAME-YOUR-ANIMATION {
	0%   { opacity: 0; }
	100% { opacity: 1; }
}
@-ms-keyframes NAME-YOUR-ANIMATION {
	0%   { opacity: 0; }

ikhattab

/**
 * my first dabblet
 */
body{
	background: #444;
	margin: 200px auto;
	width:1000px;
	}

ikhattab

/**
 * my first dabblet
 */
body{
	background: #444;
	margin: 200px auto;
	width:1000px;
	}

ikhattab

/**
 * my first dabblet
 */
body{
	background: #444;
	margin: 200px auto;
	width:1000px;
	}

ikhattab

/**
 * The first commented line is your dabblet’s title
 */

background: #f06;
background: 15s 58px linear-gradient(45deg, #f06, yellow);
min-height: 100%;

ikhattab

/**
 * heading 
 */

body{
	background: #f06;
	background: linear-gradient(45deg, #f06, yellow);
	min-height: 100%;
	}

ikhattab

/**
 * heading 
 */

body{
	background: #f06;
	background: linear-gradient(45deg, #f06, yellow);
	min-height: 100%;
	}

ikhattab

  /**
   *	Assign a value to the delimited key in the given object. The inverse of `_.lookup`
   *
   *	@example
   *
   *      var myObj = {};
   *
   *	  _.assign(myObj, 'foo.bar', 'baz'); // myObj = { foo: { bar: 'baz' }}
   *
   *	@param	{Object}  obj the object to assign to