added CSRF protection using csurf express middleware, fixes #455

2025-11-02 03:16:11 +01:00 · 2019-03-24 22:41:53 +01:00
parent f6413d095c
commit 9fc5d328b4
11 changed files with 87 additions and 15 deletions
--- a/src/routes/index.js
+++ b/src/routes/index.js
@@ -12,6 +12,7 @@ async function index(req, res) {
    const view = req.cookies['trilium-device'] === 'mobile' ? 'mobile' : 'desktop';

    res.render(view, {
+        csrfToken: req.csrfToken(),
        theme: options.theme,
        leftPaneMinWidth: parseInt(options.leftPaneMinWidth),
        leftPaneWidthPercent: parseInt(options.leftPaneWidthPercent),