root
/
threadr.lostcave.ddnss.de
3
1
Fork 2
Code Issues 1 Pull Requests 1 Projects Releases Wiki Activity

Add CSRF checks to preferences.

jocadbz
Joca 2026-03-06 14:53:14 -03:00
parent 82a7e48827
commit 730b05dd58
Signed by: jocadbz
GPG Key ID: B1836DCE2F50BDF7
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
handlers/preferences.go
View File

@ -19,6 +19,11 @@ func PreferencesHandler(app *App) http.HandlerFunc {
// Handle POST request (saving preferences) // Handle POST request (saving preferences)
if r.Method == http.MethodPost { if r.Method == http.MethodPost {
if !app.validateCSRFToken(r, session) {
http.Error(w, "Invalid CSRF token", http.StatusForbidden)
return
}
// Get form values // Get form values
autoSaveDrafts := r.FormValue("auto_save_drafts") == "on" autoSaveDrafts := r.FormValue("auto_save_drafts") == "on"
@ -70,6 +75,7 @@ func PreferencesHandler(app *App) http.HandlerFunc {
StaticPath: app.Config.ThreadrDir + "/static", StaticPath: app.Config.ThreadrDir + "/static",
CurrentURL: r.URL.RequestURI(), CurrentURL: r.URL.RequestURI(),
ContentTemplate: "preferences-content", ContentTemplate: "preferences-content",
CSRFToken: app.csrfToken(session),
}, },
Preferences: prefs, Preferences: prefs,
ShowSuccess: showSuccess, ShowSuccess: showSuccess,

1
templates/pages/preferences.html
View File

@ -11,6 +11,7 @@
{{end}} {{end}}
<section> <section>
<form method="post" action="{{.BasePath}}/preferences/"> <form method="post" action="{{.BasePath}}/preferences/">
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
<h3>Draft Auto-Save</h3> <h3>Draft Auto-Save</h3>
<label for="auto_save_drafts" style="display: flex; align-items: center; gap: 0.5em; cursor: pointer;"> <label for="auto_save_drafts" style="display: flex; align-items: center; gap: 0.5em; cursor: pointer;">
<input type="checkbox" id="auto_save_drafts" name="auto_save_drafts" {{if .Preferences.AutoSaveDrafts}}checked{{end}}> <input type="checkbox" id="auto_save_drafts" name="auto_save_drafts" {{if .Preferences.AutoSaveDrafts}}checked{{end}}>