ZapMachine/kanban/tasks/014-add-csrf-protection-to-word-input-form.md

666 B

id title status priority created updated started completed tags claimed_by claimed_at class
14 Add CSRF protection to word-input form done medium 2026-07-17T03:57:20.699057952+02:00 2026-07-19T21:23:27.817959707+02:00 2026-07-19T21:23:27.819406405+02:00 2026-07-19T21:23:27.819406405+02:00
security
rain-raven 2026-07-19T21:23:27.817959707+02:00 standard

From framework review (docs/framework_review.md), P1-2. tpl/index.tpl POSTs to mode=display which writes session state and triggers image downloads. No CSRF token means a cross-site request can drive the machine. Fix: add session-bound CSRF token to the form, validate in ZAPDisplay.