Fix XSS, CSRF, input validation, and related security issues

2026-04-14 16:00:50 -05:00
parent e0f04ea971
commit 270acc0430
7 changed files with 86 additions and 33 deletions
@@ -349,6 +349,18 @@
      navigator.serviceWorker.register('/sw.js');
    }

+    // Inject CSRF token into all POST forms
+    document.addEventListener('DOMContentLoaded', function() {
+      var token = '{{ csrf_token() }}';
+      document.querySelectorAll('form').forEach(function(form) {
+        if (form.method.toLowerCase() === 'post') {
+          var inp = document.createElement('input');
+          inp.type = 'hidden'; inp.name = 'csrf_token'; inp.value = token;
+          form.appendChild(inp);
+        }
+      });
+    });
+
    (function() {
      var modal     = document.getElementById('confirm-modal');
      var msgEl     = document.getElementById('confirm-modal-msg');