Provide a way for sites to pre-fill the openid login form

[François Marier]

Fedora Badges (https://badges.fedoraproject.org/user/fmarier) currently has a "Change avatar" button that uses this code:

<form method="POST" action="https://www.libravatar.org/openid/login/">
<input name="openid_identifier" value="http://fmarier.id.fedoraproject.org/" type="hidden">
<input class="pretty-submit" style="height: 50px; width: 100%;" name="change-avatar" value="Change Avatar" type="submit">
</form>

which fails with a CSRF error message:

  Forbidden (403)

  CSRF verification failed. Request aborted.

because the CSRF token is missing from that request.

While we can't open this up completely, since that would enable login fixation, we could add a parameter on the OpenID login page to pre-fill the address in that form.

[François Marier (fmarier)]

The easiest fix is probably to use "openid_identifier" for the parameter name and then change the Fedora Badges to a GET form action.

Patches can be sent here: https://github.com/fedora-infra/tahrir

[François Marier (fmarier)]

Clicking on the avatar logo from https://apps.fedoraproject.org/notifications/fmarier.id.fedoraproject.org/ also uses the same form code.

The source code for this app is here: https://github.com/fedora-infra/fmn

[François Marier (fmarier)]

Patches submitted for the two Fedora sites:

https://github.com/fedora-infra/tahrir/pull/368
https://github.com/fedora-infra/fmn/pull/214