mirror/Notes
1
0
Fork 0
mirror of https://github.com/TriliumNext/Notes.git synced 2026-01-30 09:08:35 -06:00
Code Issues Packages Projects Releases Wiki Activity

added CSRF protection using csurf express middleware, fixes #455

Browse Source
This commit is contained in:
zadam
2019-03-24 22:41:53 +01:00
parent f6413d095c
commit 9fc5d328b4
11 changed files with 87 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/public/javascripts/desktop.js
View File

@@ -98,7 +98,8 @@ $(document).on("click", "button[data-help-page]", e => {
$("#logout-button").toggle(!utils.isElectron());
$("#logout-button").click(() => {
const $logoutForm = $('<form action="logout" method="POST">');
const $logoutForm = $('<form action="logout" method="POST">')
.append($(`<input type="hidden" name="_csrf" value="${glob.csrfToken}"/>`));
$("body").append($logoutForm);
$logoutForm.submit();

4
src/public/javascripts/services/server.js
View File

@@ -1,4 +1,3 @@
import protectedSessionHolder from './protected_session_holder.js';
import utils from './utils.js';
import infoService from "./info.js";
@@ -7,7 +6,8 @@ function getHeaders() {
// so hypothetical protectedSessionId becomes protectedsessionid on the backend
// also avoiding using underscores instead of dashes since nginx filters them out by default
return {
'trilium-source-id': glob.sourceId
'trilium-source-id': glob.sourceId,
'x-csrf-token': glob.csrfToken
};
}