public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 11:45:56 +00:00
Code Issues Releases Wiki Activity

public/logout: require valid CSRF token

Browse Source
This commit is contained in:
Andrew Dolgov
2020-09-15 16:59:11 +03:00
parent cbcb10a272
commit 154417d80b
3 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
js/App.js
View File

@@ -127,6 +127,28 @@ const App = {
}
);
},
postCurrentWindow: function(target, params) {
const form = document.createElement("form");
form.setAttribute("method", "post");
form.setAttribute("action", App.getInitParam("self_url_prefix") + "/" + target);
for (const [k,v] of Object.entries(params)) {
const field = document.createElement("input");
field.setAttribute("name", k);
field.setAttribute("value", v);
field.setAttribute("type", "hidden");
form.appendChild(field);
}
document.body.appendChild(form);
form.submit();
form.parentNode.removeChild(form);
},
postOpenWindow: function(target, params) {
const w = window.open("");
@@ -1143,7 +1165,7 @@ const App = {
document.location.href = "prefs.php";
break;
case "qmcLogout":
document.location.href = "backend.php?op=logout";
App.postCurrentWindow("public.php", {op: "logout", csrf_token: __csrf_token});
break;
case "qmcTagCloud":
this.displayDlg(__("Tag cloud"), "printTagCloud");