Dockery/Trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-11-13 08:45:50 +01:00
Code Issues Packages Projects Releases Activity

added CSRF protection using csurf express middleware, fixes #455

Browse Source
This commit is contained in:
zadam
2019-03-24 22:41:53 +01:00
parent f6413d095c
commit 9fc5d328b4
11 changed files with 87 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/views/desktop.ejs
View File

@@ -237,7 +237,8 @@
activeDialog: null,
sourceId: '<%= sourceId %>',
maxSyncIdAtLoad: <%= maxSyncIdAtLoad %>,
instanceName: '<%= instanceName %>'
instanceName: '<%= instanceName %>',
csrfToken: '<%= csrfToken %>'
};
window.appCssNoteIds = <%- JSON.stringify(appCssNoteIds) %>;
</script>

7
src/views/mobile.ejs
View File

@@ -68,7 +68,9 @@
<div class="dropdown-menu dropdown-menu-sm" id="context-menu-container"></div>
<form action="logout" id="logout-form" method="POST" style="display: none;"></form>
<form action="logout" id="logout-form" method="POST" style="display: none;">
<input type="hidden" name="_csrf" value="<%= csrfToken %>"/>
</form>
</div>
<script type="text/javascript">
@@ -78,7 +80,8 @@
activeDialog: null,
sourceId: '<%= sourceId %>',
maxSyncIdAtLoad: <%= maxSyncIdAtLoad %>,
instanceName: '<%= instanceName %>'
instanceName: '<%= instanceName %>',
csrfToken: '<%= csrfToken %>'
};
</script>