Added csrf token to html forms

Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
8 years ago · cf849ee948
parent d5ccb9bb78
commit cf849ee948
14 changed files with 16 additions and 0 deletions
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/albumMain.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/albumMain.jsp
@ -278,6 +278,7 @@

 <div id="commentForm" style="display:none">
    <form method="post" action="setMusicFileInfo.view">
+        <sec:csrfInput />
        <input type="hidden" name="action" value="comment">
        <input type="hidden" name="id" value="${model.dir.id}">
        <textarea name="comment" rows="6" cols="70">${model.dir.comment}</textarea>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/artistMain.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/artistMain.jsp
@ -208,6 +208,7 @@

 <div id="commentForm" style="display:none">
    <form method="post" action="setMusicFileInfo.view">
+        <sec:csrfInput />
        <input type="hidden" name="action" value="comment">
        <input type="hidden" name="id" value="${model.dir.id}">
        <textarea name="comment" rows="6" cols="70">${model.dir.comment}</textarea>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/changeCoverArt.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/changeCoverArt.jsp
@ -91,6 +91,7 @@
 <body class="mainframe bgcolor1" onload="search()">
 <h1><fmt:message key="changecoverart.title"/></h1>
 <form action="javascript:search()">
+    <sec:csrfInput />
    <table class="indent"><tr>
        <td><input id="artist" name="artist" placeholder="<fmt:message key="changecoverart.artist"/>" size="35" type="text" value="${model.artist}" onclick="select()"/></td>
        <td><input id="album" name="album" placeholder="<fmt:message key="changecoverart.album"/>" size="35" type="text" value="${model.album}" onclick="select()"/></td>
@ -99,6 +100,7 @@
 </form>

 <form action="javascript:setImage(dwr.util.getValue('url'))">
+    <sec:csrfInput />
    <table><tr>
        <td><label for="url"><fmt:message key="changecoverart.address"/></label></td>
        <td style="padding-left:0.5em"><input type="text" name="url" size="50" id="url" value="http://" onclick="select()"/></td>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/db.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/db.jsp
@ -7,6 +7,7 @@
 <h1>Database query</h1>

 <form method="post" action="db.view">
+    <sec:csrfInput />
    <textarea rows="10" cols="80" id="query" name="query" style="margin-top:1em">${model.query}</textarea>
    <input type="submit" value="<fmt:message key="common.ok"/>">
 </form>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/dlnaSettings.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/dlnaSettings.jsp
@ -34,6 +34,7 @@
 </c:import>

 <form method="post" action="dlnaSettings.view">
+    <sec:csrfInput />

    <div>
        <input type="checkbox" name="dlnaEnabled" id="dlnaEnabled" class="checkbox"
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/importPlaylist.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/importPlaylist.jsp
@ -30,6 +30,7 @@
    <fmt:message key="importPlaylist.text"/>
 </div>
 <form method="post" enctype="multipart/form-data" action="importPlaylist.view">
+    <sec:csrfInput />
    <input type="file" id="file" name="file" size="40"/>
    <input type="submit" value="<fmt:message key="common.ok"/>"/>
 </form>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/internetRadioSettings.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/internetRadioSettings.jsp
@ -12,6 +12,7 @@
 </c:import>

 <form method="post" action="internetRadioSettings.view">
+<sec:csrfInput />
 <table class="indent">
    <tr>
        <th><fmt:message key="internetradiosettings.name"/></th>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/more.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/more.jsp
@ -122,6 +122,7 @@
    </h2>

    <form id="randomPlayQueue" method="post" action="randomPlayQueue.view?">
+        <sec:csrfInput />
        <table>
            <tr>
                <td><fmt:message key="more.random.text"/></td>
@ -291,6 +292,7 @@
    </h2>

    <form method="post" enctype="multipart/form-data" action="upload.view">
+        <sec:csrfInput />
        <table>
            <tr>
                <td><fmt:message key="more.upload.source"/></td>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/personalSettings.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/personalSettings.jsp
@ -241,6 +241,7 @@
 </form:form>

 <form method="post" enctype="multipart/form-data" action="avatarUpload.view">
+    <sec:csrfInput />
    <table>
        <tr>
            <td style="padding-right:1em"><fmt:message key="personalsettings.avatar.changecustom"/></td>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/recover.jsp
@ -8,6 +8,7 @@
 <body class="mainframe bgcolor1" onload="document.getElementById('usernameOrEmail').focus()">

 <form action="recover.view" method="POST">
+    <sec:csrfInput />
    <div class="bgcolor2 shadow" style="padding:20px 50px 20px 50px; margin-top:100px;margin-left:50px;margin-right:50px">

        <div style="margin-left: auto; margin-right: auto; width: 45em">
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/shareSettings.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/shareSettings.jsp
@ -14,6 +14,7 @@
 </c:import>

 <form method="post" action="shareSettings.view">
+    <sec:csrfInput />

    <table class="music indent">
        <tr>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/sonosSettings.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/sonosSettings.jsp
@ -34,6 +34,7 @@
 </c:import>

 <form method="post" action="sonosSettings.view">
+    <sec:csrfInput />

    <div>
        <input type="checkbox" name="sonosEnabled" id="sonosEnabled" class="checkbox"
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/top.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/top.jsp
@ -125,6 +125,7 @@

        <td style="padding-left:1em">
            <form method="post" action="search.view" target="main" name="searchForm">
+                <sec:csrfInput />
                <td><input type="text" name="query" id="query" size="28" placeholder="${search}" onclick="select();"
                           onkeyup="triggerInstantSearch();"></td>
                <td><a href="javascript:document.searchForm.submit()"><img src="<spring:theme code="searchImage"/>" alt="${search}" title="${search}"></a></td>
--- a/libresonic-main/src/main/webapp/WEB-INF/jsp/transcodingSettings.jsp
+++ b/libresonic-main/src/main/webapp/WEB-INF/jsp/transcodingSettings.jsp
@ -14,6 +14,7 @@
 </c:import>

 <form method="post" action="transcodingSettings.view">
+<sec:csrfInput />
 <table class="indent">
    <tr>
        <th><fmt:message key="transcodingsettings.name"/></th>