Brummel
2e3b5efe86
Adds the csrf_token hidden field to every POST form in the web UI
(logout, bulk, purge-closed, close, reopen, analyze, reset,
delete-recording). Login stays without a token — SameSite=Strict
already blocks the relevant attack shapes and forced-login CSRF
has no impact here.
Shape:
- New askama macro partials/csrf_field.html renders the hidden
input; 3 templates import + {% call csrf::field(csrf_token) %}
inside each <form method="POST">.
- AuthenticatedWebUser carries csrf_token (cloned out of the
session once during extraction) so render handlers don't need a
second store lookup.
- 3 template structs (MyCasesTemplate, CasePageTemplate,
CaseRecordingsTemplate) gain the field; render sites pass
user.csrf_token through.
Safety-net tests:
- Each rendered page must contain the exact session csrf_token in
a hidden input — catches anyone adding a new form without the
macro.
- Happy-path round-trip: fetch page, parse token from HTML, POST
with token → 303. Catches drift between rendered and accepted
token formats.
13 lines
334 B
HTML
13 lines
334 B
HTML
{#-
|
|
CSRF hidden input for state-changing POST forms. Usage:
|
|
|
|
{% import "partials/csrf_field.html" as csrf %}
|
|
<form method="post" action="...">
|
|
{% call csrf::field(csrf_token) %}
|
|
...
|
|
</form>
|
|
-#}
|
|
{%- macro field(token) -%}
|
|
<input type="hidden" name="csrf_token" value="{{ token }}">
|
|
{%- endmacro -%}
|