wiktr/izbi-dns
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add CSRF protection

Browse Source
This commit is contained in:
wiktr committed 2026-08-28 14:48:58 +02:00
1 parent 8b94f36db5
commit 37442c9864
5 files changed
+197 -121
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/templates/admin.html
+12 -6
View File
@@ -7,11 +7,12 @@
<tr><th>Username</th><th>Domains</th><th>Password</th><th>Admin</th><th>Email</th><th>Delete</th></tr>
<form method="POST" action="/create-user"><tr>
<td><input type="text" name="username" placeholder="*user name" required /></td>
<td><input type="text" name="domains" placeholder="space separated domains" /></td>
<td><input type="password" name="password" placeholder="*password" required /></td>
<td><input type="checkbox" name="is_admin" /></td>
<td><input type="email" name="email" placeholder="email" /></td>
{{ create_user_form.hidden_tag() }}
<td>{{ create_user_form.username(placeholder="*Username") }}</td>
<td>{{ create_user_form.domains(placeholder="Space separated domains") }}</td>
<td>{{ create_user_form.password(placeholder="*Password") }}</td>
<td>{{ create_user_form.is_admin() }}</td>
<td>{{ create_user_form.email(placeholder="Email") }}</td>
<td><button type="submit">Add</button></td>
</tr></form>
@@ -19,28 +20,33 @@
<tr>
<td>{{ user["username"] }}</td>
<td><form method="POST" action="/update-user">
{{ update_user_form.hidden_tag() }}
<input type="hidden" name="userid" value="{{ user["userid"] }}" />
<input type="text" name="domains" placeholder="space separated domains" value="{{ user["domains"] | join(' ') }}" />
<button type="submit">update domains</button>
</form></td>
<td><form method="POST" action="/update-user">
{{ update_user_form.hidden_tag() }}
<input type="hidden" name="userid" value="{{ user["userid"] }}" />
<input type="password" name="password" placeholder="*password" required />
<button type="submit">update password</button>
</form></td>
<td><form method="POST" action="/update-user">
{{ update_user_form.hidden_tag() }}
<input type="hidden" name="userid" value="{{ user["userid"] }}" />
<input type="hidden" name="is_admin" value="{% if user["is_admin"] %}false{% else %}true{% endif %}" />
<input type="checkbox" disabled {% if user["is_admin"] %}checked{% endif %} />
<button type="submit">toggle admin</button>
</form></td>
<td><form method="POST" action="/update-user">
{{ update_user_form.hidden_tag() }}
<input type="hidden" name="userid" value="{{ user["userid"] }}" />
<input type="email" name="email" placeholder="email" value="{{ user["email"] if user["email"] }}"/>
<button type="submit">update email</button>
</form></td>
<td><form method="POST" action="/delete-user">
<input type="hidden" name="userid" value="{{ user["userid"] }}" />
{{ delete_user_form.csrf_token }}
{{ delete_user_form.userid(value=user["userid"]) }}
<button type="submit">Delete</button>
</form></td>
</tr>
app/templates/dashboard.html
+16 -9
View File
@@ -4,7 +4,11 @@
<title>Dashboard - IZBI DNS</title>
</head>
<body>
<h2>Hello {{ username }} <a href="/logout">log&nbsp;out</a></h2>
<h2>Hello {{ username }}</h2>
<form method="POST" action="/logout">
{{ logout_form.hidden_tag() }}
<button type="submit">Log&nbsp;Out</button>
</form>
{% with messages = get_flashed_messages()%}
{% if messages%}
@@ -23,14 +27,16 @@
<p>Your tokens:
<form method="POST" action="/generate-token">
<input type="text" name="token" placeholder="token name" />
<button type="submit">new&nbsp;token</button>
{{ generate_token_form.hidden_tag() }}
{{ generate_token_form.token_name(placeholder="Token Name") }}
<button type="submit">New&nbsp;Token</button>
</form>
<ul>{% for token in tokens %}
<li>
<form method="POST" action="/revoke-token">
<input type="text" name="token" readonly value="{{ token }}" />
<button type="submit">revoke</button>
{{ revoke_token_form.hidden_tag() }}
{{ revoke_token_form.token_name(placeholder="Token Name", readonly=True, value=token) }}
<button type="submit">Revoke</button>
</form>
</li>
{% endfor %}
@@ -39,10 +45,11 @@
<p>Password change
<form method="POST" action="/change-password">
<input type="password" name="pass" placeholder="old password" /><br />
<input type="password" name="pass-new" placeholder="new password" /><br />
<input type="password" name="pass-rep" placeholder="repeat password" /><br />
<button type="submit">change password</button>
{{ change_password_form.hidden_tag() }}
{{ change_password_form.password(placeholder="Old Password") }}<br />
{{ change_password_form.new_password(placeholder="New Password") }}<br />
{{ change_password_form.repeat_password(placeholder="Repeat Password") }}<br />
<button type="submit">Change Password</button>
</form>
</p>{% if is_admin %}{% include 'admin.html' %}{% endif %}
</body>
app/templates/index.html
+4 -3
View File
@@ -14,9 +14,10 @@
{%endif%}
{%endwith%}
<form method="POST" action="/login">
<input type="text" name="user" placeholder="username" required autofocus /><br />
<input type="password" name="pass" placeholder="password" required /><br />
<form method="POST" action="/">
{{ login_form.hidden_tag() }}
{{ login_form.username(placeholder="Username", autofocus=True) }}<br />
{{ login_form.password(placeholder="Password") }}<br />
<button type="submit">log in</button>
</form>
</body>