WS-2020-0141

The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitting the...

PT-2020-21453

Name of the Vulnerable Software and Affected Versions Datasette versions prior to 0.46 Description The HTML form for a read-only canned query in Datasette includes a hidden CSRF token field. When this form is submitted, the CSRF token is exposed in the URL. For example, submitting the form on...