diff options
| author | r <r@freesoftwareextremist.com> | 2020-01-25 10:07:06 +0000 |
|---|---|---|
| committer | r <r@freesoftwareextremist.com> | 2020-01-26 06:49:29 +0000 |
| commit | bf2cfaf0ede0e9744408f52538fb4bcd87a6d5b8 (patch) | |
| tree | 5d3be1dfa65395bddedd2fb6f06a990c23274f00 /templates/user.tmpl | |
| parent | 5fdc7a59b2efc60e35f5421e28986c356810456e (diff) | |
| download | bloat-bf2cfaf0ede0e9744408f52538fb4bcd87a6d5b8.tar.gz bloat-bf2cfaf0ede0e9744408f52538fb4bcd87a6d5b8.zip | |
Add CSRF protection
Diffstat (limited to 'templates/user.tmpl')
| -rw-r--r-- | templates/user.tmpl | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/templates/user.tmpl b/templates/user.tmpl index bbbce32..abf22ec 100644 --- a/templates/user.tmpl +++ b/templates/user.tmpl @@ -22,17 +22,20 @@ <span> {{if .User.Pleroma.Relationship.FollowedBy}} follows you - {{end}} </span> {{if .User.Pleroma.Relationship.Following}} <form class="d-inline" action="/unfollow/{{.User.ID}}" method="post"> - <input type="submit" value="unfollow" class="btn-link"> + <input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}"> + <input type="submit" value="unfollow" class="btn-link"> </form> {{end}} {{if .User.Pleroma.Relationship.Requested}} <form class="d-inline" action="/unfollow/{{.User.ID}}" method="post"> - <input type="submit" value="cancel request" class="btn-link"> + <input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}"> + <input type="submit" value="cancel request" class="btn-link"> </form> {{end}} {{if not .User.Pleroma.Relationship.Following}} <form class="d-inline" action="/follow/{{.User.ID}}" method="post"> - <input type="submit" value="{{if .User.Pleroma.Relationship.Requested}}resend request{{else}}follow{{end}}" class="btn-link"> + <input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}"> + <input type="submit" value="{{if .User.Pleroma.Relationship.Requested}}resend request{{else}}follow{{end}}" class="btn-link"> </form> {{end}} </div> |