From eca0e2d41364272a89f837201b79402b4f9ef2ac Mon Sep 17 00:00:00 2001
From: Matt Westcott <matt@west.co.tt>
Date: Tue, 24 Aug 2021 17:34:00 +0100
Subject: [PATCH] Add 'only' to prevent action_url from leaking into
 header.html's context and creating a spurious action button

Have confirmed that this doesn't strip out any context variables that we do rely on - IndexView is the only thing descending from the generic base template which customises the header beyond title/subtitle/icon, and it does that by explicitly passing parameters to `include`, not by having them floating around in the template context.
---
 wagtail/admin/templates/wagtailadmin/generic/base.html     | 2 +-
 wagtail/admin/templates/wagtailadmin/generic/index.html    | 4 ++--
 wagtail/admin/templates/wagtailadmin/workflows/create.html | 2 +-
 wagtail/users/templates/wagtailusers/groups/create.html    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/wagtail/admin/templates/wagtailadmin/generic/base.html b/wagtail/admin/templates/wagtailadmin/generic/base.html
index db7f9a9bf5..0a0e715376 100644
--- a/wagtail/admin/templates/wagtailadmin/generic/base.html
+++ b/wagtail/admin/templates/wagtailadmin/generic/base.html
@@ -5,7 +5,7 @@
 {% block content %}
 
     {% block header %}
-        {% include "wagtailadmin/shared/header.html" with title=page_title subtitle=page_subtitle icon=header_icon %}
+        {% include "wagtailadmin/shared/header.html" with title=page_title subtitle=page_subtitle icon=header_icon only %}
     {% endblock %}
 
     <div class="nice-padding">
diff --git a/wagtail/admin/templates/wagtailadmin/generic/index.html b/wagtail/admin/templates/wagtailadmin/generic/index.html
index b4b117f980..9b5ad73e8b 100644
--- a/wagtail/admin/templates/wagtailadmin/generic/index.html
+++ b/wagtail/admin/templates/wagtailadmin/generic/index.html
@@ -6,9 +6,9 @@
 {% block content %}
     {% if can_add %}
         {% url view.add_url_name as add_link %}
-        {% include "wagtailadmin/shared/header.html" with title=page_title subtitle=page_subtitle action_url=add_link action_text=view.add_item_label icon=header_icon %}
+        {% include "wagtailadmin/shared/header.html" with title=page_title subtitle=page_subtitle action_url=add_link action_text=view.add_item_label icon=header_icon only %}
     {% else %}
-        {% include "wagtailadmin/shared/header.html" with title=page_title subtitle=page_subtitle icon=header_icon %}
+        {% include "wagtailadmin/shared/header.html" with title=page_title subtitle=page_subtitle icon=header_icon only %}
     {% endif %}
 
     {% block listing %}
diff --git a/wagtail/admin/templates/wagtailadmin/workflows/create.html b/wagtail/admin/templates/wagtailadmin/workflows/create.html
index 467505be83..036bd5c44d 100644
--- a/wagtail/admin/templates/wagtailadmin/workflows/create.html
+++ b/wagtail/admin/templates/wagtailadmin/workflows/create.html
@@ -24,7 +24,7 @@
 {% endblock %}
 
 {% block content %}
-    {% include "wagtailadmin/shared/header.html" with title=view.page_title icon=view.header_icon merged=1 %}
+    {% include "wagtailadmin/shared/header.html" with title=view.page_title icon=view.header_icon merged=1 only %}
 
     <form action="{{ view.get_add_url }}" enctype="multipart/form-data" method="POST" novalidate>
         {% csrf_token %}
diff --git a/wagtail/users/templates/wagtailusers/groups/create.html b/wagtail/users/templates/wagtailusers/groups/create.html
index e79f8e2873..173b50edb8 100644
--- a/wagtail/users/templates/wagtailusers/groups/create.html
+++ b/wagtail/users/templates/wagtailusers/groups/create.html
@@ -13,7 +13,7 @@
 {% block content %}
 
     {% trans "Add group" as add_group_str %}
-    {% include "wagtailadmin/shared/header.html" with title=add_group_str icon="group" %}
+    {% include "wagtailadmin/shared/header.html" with title=add_group_str icon="group" only %}
 
     <div class="nice-padding">
         <form action="{% url 'wagtailusers_groups:add' %}" method="POST" novalidate>