tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add CSRF protection to every form that changes data.

Browse Source 
The logout link carries the token too, and the cookies get SameSite=Lax.
This commit is contained in:
tim
2026-09-25 21:38:22 +02:00
parent f6bdf10228
commit 41c46a43c6
9 changed files with 53 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sidebar.inc.php
+1 -1
View File
@@ -29,7 +29,7 @@ if (preg_match("#^(/$|/index|/article)#", $_SERVER['REQUEST_URI'])) {
<li><a href="/publish">Add</a>/<a href="/publish/edit" class="sidelink">Edit</a></li>
<?php if (isset($is_admin) && $is_admin) {
echo ' <li><a href="/publish/addeditor">Add editor</a></li>'."\n";
echo ' <li><a href="/publish/logout">Logout</a></li>'."\n";
echo ' <li><a href="/publish/logout?token='.csrf_token().'">Logout</a></li>'."\n";
}
//echo ' <li><a href="/policy">Publishing policy</a></li>';
?>