666 B
666 B
| id | title | status | priority | created | updated | started | completed | tags | claimed_by | claimed_at | class | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 14 | Add CSRF protection to word-input form | done | medium | 2026-07-17T03:57:20.699057952+02:00 | 2026-07-19T21:23:27.817959707+02:00 | 2026-07-19T21:23:27.819406405+02:00 | 2026-07-19T21:23:27.819406405+02:00 |
|
rain-raven | 2026-07-19T21:23:27.817959707+02:00 | standard |
From framework review (docs/framework_review.md), P1-2. tpl/index.tpl POSTs to mode=display which writes session state and triggers image downloads. No CSRF token means a cross-site request can drive the machine. Fix: add session-bound CSRF token to the form, validate in ZAPDisplay.