user01/calibre-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added handling for missing flask-wtf dependency

Browse Source 
Added CSRF protection (via flask-wtf)
Moved upload function to js file
Fixed error page in case of csrf failure
This commit is contained in:
Ozzie Isaacs
2021-10-04 19:23:20 +02:00
parent 5edde53fed
commit 50919d4721
25 changed files with 92 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cps/templates/email_edit.html
+8 -5
View File
@@ -7,6 +7,7 @@
<div class="discover">
<h1>{{title}}</h1>
<form role="form" class="col-md-10 col-lg-6" method="POST">
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
{% if feature_support['gmail'] %}
<div class="form-group">
<label for="config_email_type">{{_('Choose Server Type')}}</label>
@@ -72,6 +73,7 @@
<div class="col-md-10 col-lg-6">
<h2>{{_('Allowed Domains (Whitelist)')}}</h2>
<form id="domain_add_allow" action="{{ url_for('admin.add_domain',allow=1)}}" method="POST">
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
<div class="form-group required">
<label for="domainname_allow">{{_('Add Domain')}}</label>
<input type="text" class="form-control" name="domainname" id="domainname_allow" >
@@ -98,11 +100,12 @@
</thead>
</table>
<form id="domain_add_deny" action="{{ url_for('admin.add_domain',allow=0)}}" method="POST">
<div class="form-group required">
<label for="domainname_deny">{{_('Add Domain')}}</label>
<input type="text" class="form-control" name="domainname" id="domainname_deny" >
</div>
<button id="domain_deny_submit" class="btn btn-default">{{_('Add')}}</button>
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
<div class="form-group required">
<label for="domainname_deny">{{_('Add Domain')}}</label>
<input type="text" class="form-control" name="domainname" id="domainname_deny" >
</div>
<button id="domain_deny_submit" class="btn btn-default">{{_('Add')}}</button>
</form>
</div>