Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.
2026-09-25 21:38:22 +02:00
parent f6bdf10228
commit 41c46a43c6
9 changed files with 53 additions and 5 deletions
@@ -77,6 +77,11 @@ if (isset($_POST['action'])) {
 if (!isset($action) && $id) {
  $action = 'edit';
 }
+// A POST without a valid CSRF token only gets a preview
+if (isset($_POST['action']) && !csrf_valid()) {
+  $validate['csrf'] = 'Your session has expired. Please check the story, then send it again.';
+  $action = 'preview';
+}

 switch ($action) {
  case 'submit':    // to queue