brammie15/ReSendit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CSRF protection for cookie-authenticated requests

Browse Source
This commit is contained in:
root
2026-03-23 16:20:26 +01:00
parent a3348e8795
commit fae7f80913
8 changed files with 139 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
templates/admin.html
View File

@@ -150,11 +150,13 @@
<td>
<div class="btn-group">
{{if not .Deleted}}
<form action="/api/files/admin/delete/{{.ID}}" method="GET" onsubmit="return openConfirm(event, 'TERMINATE', 'Kill this file? It will be removed from active storage.')">
<form action="/api/files/admin/delete/{{.ID}}" method="POST" onsubmit="return openConfirm(event, 'TERMINATE', 'Kill this file? It will be removed from active storage.')">
<input type="hidden" name="_csrf" class="csrf-field">
<button type="submit" style="background: #ffcccc;">Terminate</button>
</form>
{{end}}
<form action="/api/files/admin/delete/fr/{{.ID}}" method="GET" onsubmit="return openConfirm(event, 'FULL_WIPE', 'Wiping file and purging record? This is a permanent database scrub.')">
<form action="/api/files/admin/delete/fr/{{.ID}}" method="POST" onsubmit="return openConfirm(event, 'FULL_WIPE', 'Wiping file and purging record? This is a permanent database scrub.')">
<input type="hidden" name="_csrf" class="csrf-field">
<button type="submit">Full_Wipe</button>
</form>
</div>
@@ -202,6 +204,13 @@
currentForm = null;
}
// Fill CSRF hidden inputs from cookie (double-submit pattern)
(function fillCSRF() {
const m = document.cookie.match('(^|;)\\s*csrf_token\\s*=\\s*([^;]+)');
const tok = m ? m.pop() : '';
document.querySelectorAll('.csrf-field').forEach(el => el.value = tok);
})();
document.getElementById('modal-confirm-btn').addEventListener('click', () => {
if (currentForm) {
currentForm.submit();