CSRF prevention

1 files changed, 5 insertions, 1 deletions

diff --git a/forms.lua b/forms.lua
index d4084a4..50ee140 100644
--- a/forms.lua
+++ b/forms.lua
@@ -86,13 +86,15 @@ function M.connect(uid, token, meta, endpoint)
 	end)
 end
 
-function M.user_settings(user, messages)
+function M.user_settings(user, token, messages)
 	show_messages(messages)
 	html.form({method = "POST"}, function()
+		hidden('token', token)
 		input('text', 'username',
 			"username: ", user:get "username", "change")
 	end)
 	html.form({method = "POST"}, function()
+		hidden('token', token)
 		input('email', 'email',
 			"email: ", user:get "email", "change")
 	end)
@@ -102,11 +104,13 @@ function M.user_settings(user, messages)
 		input('password', 'password', "current password: ")
 		input('password', 'new_password', "new password: ")
 		input('password', 'confirm_password', "confirm password: ")
+		hidden('token', token)
 		input('submit', nil, nil, "change")
 	end)
 	html.h3 "log out"
 	html.form({method = "POST"}, function()
 		hidden('logout', 'yes')
+		hidden('token', token)
 		input('checkbox', 'everywhere',
 			"log out everywhere", nil, "log out")
 	end)