From bf2cfaf0ede0e9744408f52538fb4bcd87a6d5b8 Mon Sep 17 00:00:00 2001
From: r <r@freesoftwareextremist.com>
Date: Sat, 25 Jan 2020 10:07:06 +0000
Subject: Add CSRF protection

---
 templates/status.tmpl | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'templates/status.tmpl')

diff --git a/templates/status.tmpl b/templates/status.tmpl
index 09c1354..fd5339a 100644
--- a/templates/status.tmpl
+++ b/templates/status.tmpl
@@ -109,12 +109,14 @@
 					{{else}}
 					{{if .Reblogged}}
 					<form class="status-retweet" data-action="unretweet" action="/unretweet/{{.ID}}" method="post">
-						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}" />
+						<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}">
 						<input type="image" src="{{GetIcon "retweeted" $.Ctx.DarkMode}}" alt="undo retweet" class="icon" title="undo retweet">
 					</form>
 					{{else}}
 					<form class="status-retweet" data-action="retweet" action="/retweet/{{.ID}}" method="post">
-						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}" />
+						<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}">
 						<input type="image" src="{{GetIcon "retweet" $.Ctx.DarkMode}}" alt="retweet" class="icon" title="retweet">
 					</form>
 					{{end}}
@@ -126,12 +128,14 @@
 				<div class="status-action">
 					{{if .Favourited}}
 					<form class="status-like" data-action="unlike" action="/unlike/{{.ID}}" method="post">
-						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}" />
+						<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}">
 						<input type="image" src="{{GetIcon "liked" $.Ctx.DarkMode}}" alt="unlike" class="icon" title="unlike">
 					</form>
 					{{else}}
 					<form class="status-like" data-action="like" action="/like/{{.ID}}" method="post">
-						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}" />
+						<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+						<input type="hidden" name="retweeted_by_id" value="{{.RetweetedByID}}">
 						<input type="image" src="{{GetIcon "star-o" $.Ctx.DarkMode}}" alt="like" class="icon" title="like">
 					</form>
 					{{end}}
-- 
cgit v1.2.3