From bf2cfaf0ede0e9744408f52538fb4bcd87a6d5b8 Mon Sep 17 00:00:00 2001
From: r <r@freesoftwareextremist.com>
Date: Sat, 25 Jan 2020 10:07:06 +0000
Subject: Add CSRF protection

---
 templates/user.tmpl | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'templates/user.tmpl')

diff --git a/templates/user.tmpl b/templates/user.tmpl
index bbbce32..abf22ec 100644
--- a/templates/user.tmpl
+++ b/templates/user.tmpl
@@ -22,17 +22,20 @@
 			<span> {{if .User.Pleroma.Relationship.FollowedBy}} follows you - {{end}} </span>  
 			{{if .User.Pleroma.Relationship.Following}} 
 			<form class="d-inline" action="/unfollow/{{.User.ID}}" method="post">
-			    <input type="submit" value="unfollow" class="btn-link">
+				<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+				<input type="submit" value="unfollow" class="btn-link">
 			</form>
 			{{end}} 
 			{{if .User.Pleroma.Relationship.Requested}} 
 			<form class="d-inline" action="/unfollow/{{.User.ID}}" method="post">
-			    <input type="submit" value="cancel request" class="btn-link">
+				<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+				<input type="submit" value="cancel request" class="btn-link">
 			</form>
 			{{end}} 
 			{{if not .User.Pleroma.Relationship.Following}} 
 			<form class="d-inline" action="/follow/{{.User.ID}}" method="post">
-			    <input type="submit" value="{{if .User.Pleroma.Relationship.Requested}}resend request{{else}}follow{{end}}" class="btn-link">
+				<input type="hidden" name="csrf_token" value="{{$.Ctx.CSRFToken}}">
+				<input type="submit" value="{{if .User.Pleroma.Relationship.Requested}}resend request{{else}}follow{{end}}" class="btn-link">
 			</form>
 			{{end}} 
 		</div>
-- 
cgit v1.2.3