17 lines
666 B
Markdown
17 lines
666 B
Markdown
|
---
|
||
|
|
id: 14
|
||
|
|
title: Add CSRF protection to word-input form
|
||
|
|
status: done
|
||
|
|
priority: medium
|
||
|
|
created: 2026-07-17T03:57:20.699057952+02:00
|
||
|
|
updated: 2026-07-19T21:23:27.817959707+02:00
|
||
|
|
started: 2026-07-19T21:23:27.819406405+02:00
|
||
|
|
completed: 2026-07-19T21:23:27.819406405+02:00
|
||
|
|
tags:
|
||
|
|
- security
|
||
|
|
claimed_by: rain-raven
|
||
|
|
claimed_at: 2026-07-19T21:23:27.817959707+02:00
|
||
|
|
class: standard
|
||
|
|
---
|
||
|
|
|
||
|
|
From framework review (docs/framework_review.md), P1-2. tpl/index.tpl POSTs to mode=display which writes session state and triggers image downloads. No CSRF token means a cross-site request can drive the machine. Fix: add session-bound CSRF token to the form, validate in ZAPDisplay.
|