zydronium/neocities
1
0
Fork 0
mirror of https://github.com/neocities/neocities.git synced 2025-04-25 01:32:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix for CSRF token in cached index

Browse source
This commit is contained in:
Kyle Drake 2024-08-19 10:16:09 -05:00
parent 72d148b237
commit 601f58e025
3 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/index.rb
View file

@ -48,11 +48,12 @@ get '/?' do
@create_disabled = false @create_disabled = false
@index_rendered = SimpleCache.store :index, erb(:index, layout: :index_layout), (ENV['RACK_ENV'] == 'test' ? -1 : 1.hour) @index_rendered = SimpleCache.store :index, erb(:index, layout: :index_layout), (ENV['RACK_ENV'] == 'test' ? -1 : 1.hour)
return @index_rendered
else else
return SimpleCache.get(:index) @index_rendered = SimpleCache.get(:index)
end end
@index_rendered.gsub! 'CSRF_TOKEN_HERE', csrf_token
@index_rendered
end end
get '/welcome' do get '/welcome' do

2
views/_index_signup_script.erb
View file

@ -30,7 +30,7 @@
}) })
$('input[type=text],input[type=password],input[type=email]').on('change focusout', function(obj) { $('input[type=text],input[type=password],input[type=email]').on('change focusout', function(obj) {
$.post('/create_validate', {field: obj.target.name, value: obj.target.value, is_education: $('input[name=is_education]')[0].value, csrf_token: '<%= csrf_token %>'}, function(res) { $.post('/create_validate', {field: obj.target.name, value: obj.target.value, is_education: $('input[name=is_education]')[0].value, csrf_token: 'CSRF_TOKEN_HERE'}, function(res) {
if(res.result == 'ok') { if(res.result == 'ok') {
return $(obj.target).tooltip('hide') return $(obj.target).tooltip('hide')
} }

2
views/index.erb
View file

@ -91,7 +91,7 @@
</div> </div>
<% else %> <% else %>
<form id="createSiteForm" class="signup-Form" onsubmit="return false"> <form id="createSiteForm" class="signup-Form" onsubmit="return false">
<input type="hidden" name="csrf_token" value="<%= csrf_token %>"> <input type="hidden" name="csrf_token" value="CSRF_TOKEN_HERE">
<input type="hidden" name="is_education" value="false"> <input type="hidden" name="is_education" value="false">
<fieldset class="content"> <fieldset class="content">
<h2 class="gamma">Sign up for free</h2> <h2 class="gamma">Sign up for free</h2>