zhaojunzhe
/
fair-web
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
Browse Source

Add CSRF token

master
Menci 8 years ago
parent
a0bb9c7e58
commit
69eb2b0cc8
4 changed files with 20 additions and 1 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 3
      app.js
  2. 1
      package.json
  3. 15
      static/script.js
  4. 2
      views/header.ejs

3
app.js
Unescape View File

@ -60,6 +60,9 @@ global.syzoj = {
let multer = require('multer'); let multer = require('multer');
app.multer = multer({ dest: syzoj.utils.resolvePath(syzoj.config.upload_dir, 'tmp') }); app.multer = multer({ dest: syzoj.utils.resolvePath(syzoj.config.upload_dir, 'tmp') });
let csurf = require('csurf');
app.use(csurf({ cookie: true }));
await this.connectDatabase(); await this.connectDatabase();
this.loadHooks(); this.loadHooks();
this.loadModules(); this.loadModules();

1
package.json
Unescape View File

@ -29,6 +29,7 @@
"cheerio": "^1.0.0-rc.1", "cheerio": "^1.0.0-rc.1",
"cookie-parser": "^1.4.3", "cookie-parser": "^1.4.3",
"cssfilter": "0.0.10", "cssfilter": "0.0.10",
"csurf": "^1.9.0",
"download": "^5.0.3", "download": "^5.0.3",
"ejs": "^2.5.2", "ejs": "^2.5.2",
"express": "^4.14.0", "express": "^4.14.0",

15
static/script.js
Unescape View File

@ -7,7 +7,22 @@ $(function () {
form.method = 'post'; form.method = 'post';
form.action = $(this).attr('href-post'); form.action = $(this).attr('href-post');
form.target = '_self'; form.target = '_self';
var input = document.createElement('input');
input.type = 'hidden';
input.name = '_csrf';
input.value = document.head.getAttribute('data-csrf-token');
form.appendChild(input);
document.body.appendChild(form); document.body.appendChild(form);
form.submit(); form.submit();
}); });
$('form').each(function () {
var input = document.createElement('input');
input.type = 'hidden';
input.name = '_csrf';
input.value = document.head.getAttribute('data-csrf-token');
this.appendChild(input);
});
}); });

2
views/header.ejs
Unescape View File

@ -1,7 +1,7 @@
<% include util %> <% include util %>
<!DOCTYPE html> <!DOCTYPE html>
<html lang="zh-CN"> <html lang="zh-CN">
<head> <head data-csrf-token="<%= req.csrfToken() %>">
<meta charset="utf-8"> <meta charset="utf-8">
<meta content="IE=edge" http-equiv="X-UA-Compatible"> <meta content="IE=edge" http-equiv="X-UA-Compatible">
<title><%= title %> - <%= syzoj.config.title %></title> <title><%= title %> - <%= syzoj.config.title %></title>

Write Preview
Loading…
Cancel
Save