kibi/f0ckm
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix scroller tagging invalid csrf token

Browse Source
This commit is contained in:
Kibi Kelburton
2026-07-26 21:20:00 +02:00
parent 44af6ae061
commit e61e24dfe8
2 changed files with 23 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
public/s/js/scroller.js
View File

@@ -1000,9 +1000,10 @@
e.stopPropagation(); e.stopPropagation();
const itemId = slide.dataset.id; const itemId = slide.dataset.id;
try { try {
const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
const resp = await fetch(`/api/v2/tags/${itemId}/${encodeURIComponent(tag)}`, { const resp = await fetch(`/api/v2/tags/${itemId}/${encodeURIComponent(tag)}`, {
method: 'DELETE', method: 'DELETE',
headers: { 'x-csrf-token': window.scrollerCsrf || '' } headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
}); });
const data = await resp.json(); const data = await resp.json();
if (data.success) pill.remove(); if (data.success) pill.remove();
@@ -1157,10 +1158,14 @@
if (nowFaved) flashFav(slide); if (nowFaved) flashFav(slide);
} }
try { try {
const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
const resp = await fetch('/api/v2/togglefav', { const resp = await fetch('/api/v2/togglefav', {
method: 'POST', method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, headers: {
body: `postid=${id}` 'Content-Type': 'application/x-www-form-urlencoded',
...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
},
body: `postid=${id}${csrfToken ? `&csrf_token=${encodeURIComponent(csrfToken)}` : ''}`
}); });
const data = await resp.json(); const data = await resp.json();
// Sync count to server truth (handles race conditions) // Sync count to server truth (handles race conditions)
@@ -1582,9 +1587,10 @@
e.stopPropagation(); e.stopPropagation();
const itemId = slide.dataset.id; const itemId = slide.dataset.id;
try { try {
const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
const resp = await fetch(`/api/v2/tags/${itemId}/${encodeURIComponent(t)}`, { const resp = await fetch(`/api/v2/tags/${itemId}/${encodeURIComponent(t)}`, {
method: 'DELETE', method: 'DELETE',
headers: { 'x-csrf-token': window.scrollerCsrf || '' } headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
}); });
const data = await resp.json(); const data = await resp.json();
if (data.success) pill.remove(); if (data.success) pill.remove();
@@ -1850,11 +1856,12 @@
else if (item.external_board === 'gif') rating = 'nsfw'; else if (item.external_board === 'gif') rating = 'nsfw';
try { try {
const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
const resp = await fetch('/api/v2/scroller/rehost', { const resp = await fetch('/api/v2/scroller/rehost', {
method: 'POST', method: 'POST',
headers: { headers: {
'Content-Type': 'application/x-www-form-urlencoded', 'Content-Type': 'application/x-www-form-urlencoded',
'x-csrf-token': window.scrollerCsrf || '' ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
}, },
body: new URLSearchParams({ body: new URLSearchParams({
url: item.external_media_url || item.dest, url: item.external_media_url || item.dest,
@@ -1966,9 +1973,10 @@
showShareToast(info.toast); showShareToast(info.toast);
} }
const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
fetch(`/api/v2/tags/${id}/cycle-rating`, { fetch(`/api/v2/tags/${id}/cycle-rating`, {
method: 'PUT', method: 'PUT',
headers: { 'x-csrf-token': window.scrollerCsrf || '' } headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
}) })
.then(r => r.json()) .then(r => r.json())
.then(data => { .then(data => {
@@ -2909,10 +2917,14 @@
if (addTagSendBtn) addTagSendBtn.disabled = true; if (addTagSendBtn) addTagSendBtn.disabled = true;
closeSugg(); closeSugg();
try { try {
const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
const resp = await fetch(`/api/v2/tags/${targetId}`, { const resp = await fetch(`/api/v2/tags/${targetId}`, {
method: 'POST', method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, headers: {
body: `tagname=${encodeURIComponent(tag)}` 'Content-Type': 'application/x-www-form-urlencoded',
...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
},
body: `tagname=${encodeURIComponent(tag)}${csrfToken ? `&csrf_token=${encodeURIComponent(csrfToken)}` : ''}`
}); });
const data = await resp.json(); const data = await resp.json();
if (data.success) { if (data.success) {

5
src/inc/routes/apiv2/tags.mjs
View File

@@ -25,7 +25,8 @@ export default router => {
group.post(/$/, lib.loggedin, async (req, res) => { group.post(/$/, lib.loggedin, async (req, res) => {
// assign and/or create tag // assign and/or create tag
if (!req.params.postid || !req.post.tagname) { const rawTagname = req.post?.tagname || req.body?.tagname;
if (!req.params.postid || !rawTagname) {
return res.json({ return res.json({
success: false, success: false,
msg: 'missing postid or tag' msg: 'missing postid or tag'
@@ -33,7 +34,7 @@ export default router => {
} }
const postid = +req.params.postid; const postid = +req.params.postid;
const tagname = req.post.tagname?.trim(); const tagname = rawTagname.trim();
const protectedTags = ['sfw', 'nsfw', 'nsfl']; const protectedTags = ['sfw', 'nsfw', 'nsfl'];
if (protectedTags.includes(tagname.toLowerCase())) { if (protectedTags.includes(tagname.toLowerCase())) {