From b30b3bd0faae77830944def1713781c5bf1b3fab Mon Sep 17 00:00:00 2001 From: the lemons Date: Fri, 7 Apr 2023 06:27:11 -0500 Subject: CSRF prevention --- forms.lua | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'forms.lua') diff --git a/forms.lua b/forms.lua index d4084a4..50ee140 100644 --- a/forms.lua +++ b/forms.lua @@ -86,13 +86,15 @@ function M.connect(uid, token, meta, endpoint) end) end -function M.user_settings(user, messages) +function M.user_settings(user, token, messages) show_messages(messages) html.form({method = "POST"}, function() + hidden('token', token) input('text', 'username', "username: ", user:get "username", "change") end) html.form({method = "POST"}, function() + hidden('token', token) input('email', 'email', "email: ", user:get "email", "change") end) @@ -102,11 +104,13 @@ function M.user_settings(user, messages) input('password', 'password', "current password: ") input('password', 'new_password', "new password: ") input('password', 'confirm_password', "confirm password: ") + hidden('token', token) input('submit', nil, nil, "change") end) html.h3 "log out" html.form({method = "POST"}, function() hidden('logout', 'yes') + hidden('token', token) input('checkbox', 'everywhere', "log out everywhere", nil, "log out") end) -- cgit v1.2.3