Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.

publish/addeditor.php

@@ -4,9 +4,12 @@ if ( ! isset($_SERVER['HTTPS'])) {
 }
 require_once("../session.lib.php"); 
 $added = FALSE;
+$csrf_failed = FALSE;
 if (!isset($_SESSION['editor'])) {
   header("Location: https://xxx.org.za/publish/login");
   return;
+} else if (isset($_POST['adduser']) && !csrf_valid()) {
+  $csrf_failed = TRUE;
 } else if (isset($_POST['adduser'])) {
   require_once('../open_db.lib.php');
   open_db('open');
@@ -48,8 +51,12 @@ if (!isset($_SESSION['editor'])) {
 <?php if ($added) { ?>
   <p>Added editor <?= form_value($username) ?></p>
 <?php } else { ?>
+<?php if ($csrf_failed) { ?>
+  <p><strong>Your session has expired. Please try again.</strong></p>
+<?php } ?>
 
 <form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
+  <?= csrf_field() ?>
   <div class="grid">
 
     <label for="username">Username: </label>