feat(webui): add csrf tokens to all forms processing code

Closes #60
2025-05-01 08:37:28 +02:00 · 2025-05-01 08:37:28 +02:00 · 5d7b540718
commit 5d7b540718
parent 895615ad6e
15 changed files with 71 additions and 2 deletions
--- a/pkg/webui/login.go
+++ b/pkg/webui/login.go
@ -52,6 +52,9 @@ func handleLoginPOST(db *database.DB) http.Handler {
 				fmt.Errorf("failed to parse form: %w", err))
 			return
 		}
+		if !verifyCSRFToken(w, r) {
+			return
+		}
 		username := r.FormValue("username")
 		password := r.FormValue("password")