Add missing CSRF token to admin

levkk · Nov 22, 2024 · 6b435f5 · 6b435f5
1 parent 239c210
commit 6b435f5
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/rwf-admin/src/controllers/models.rs b/rwf-admin/src/controllers/models.rs
@@ -122,7 +122,10 @@ impl PageController for NewModelController {
     }
 
     async fn post(&self, req: &Request) -> Result<Response, Error> {
-        let query = req.form_data()?.into_iter();
+        let query = req
+            .form_data()?
+            .into_iter()
+            .filter(|c| c.0 != "rwf_csrf_token");
         let mut columns = vec![];
         let mut values = vec![];
         let mut table_name = vec![];

diff --git a/rwf-admin/templates/rwf_admin/model_new.html b/rwf-admin/templates/rwf_admin/model_new.html
@@ -17,6 +17,7 @@ <h1 class="d-flex align-items-center gap-2 mb-0">
 
     <div class="my-5">
         <form action="/admin/models/new" method="post">
+            <%= csrf_token() %>
             <input
                 type="hidden"
                 name="rwf_table_name"