Add missing CSRF tokens

1 files changed, 9 insertions, 0 deletions

diff --git a/src/main/resources/templates/views/settings_main.html b/src/main/resources/templates/views/settings_main.html
index 678d4c6f..a0315244 100644
--- a/src/main/resources/templates/views/settings_main.html
+++ b/src/main/resources/templates/views/settings_main.html
@@ -6,6 +6,7 @@
     <h2 style="color: red; padding: 20px;">Verify your account by adding email or social account</h2>
     {% endif %}
     <form action="/settings" method="POST" enctype="multipart/form-data">
+        <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
         <fieldset>
             <legend>Notification options</legend>
             <p><input type="checkbox" name="jnotify" value="1" {% if notify_options.repliesEnabled %}
@@ -22,6 +23,7 @@
             Telegram</legend>
         {% if telegram_name is not empty %}
         <form action="/settings" method="post">
+            <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
             <div>Telegram: <b>{{ telegram_name }}</b> &mdash;
                 <input type="hidden" name="page" value="telegram-del"/>
                 <input type="submit" value="  Disable  " {% if not beans.userServiceImpl.canDeleteTelegramUser(visitor) %}disabled="disabled"{% endif %} class="Button" />
@@ -34,6 +36,7 @@
     </fieldset>
     {% if jids | length > 0 %}
     <form action="/settings" method="POST" enctype="multipart/form-data">
+        <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
         <fieldset>
             <legend style="background: url(//static.juick.com/settings/xmpp.png) no-repeat; padding-left: 58px; line-height: 48px;">
                 XMPP accounts
@@ -63,6 +66,7 @@
             E-mail
         </legend>
         <form action="/settings" method="POST" enctype="multipart/form-data">
+            <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
             <p>Add account:<br/>
                 <input type="text" name="account"/>
                 <input type="hidden" name="page" value="email-add"/>
@@ -70,6 +74,7 @@
             </p>
         </form>
         <form action="/settings" method="POST" enctype="multipart/form-data">
+            <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
             <p>Your accounts:</p>
             <p>
                 {% for email in emails %}
@@ -87,6 +92,7 @@
         {% if emails is not empty %}
         <!--email_off-->
         <form action="/settings" method="POST" enctype="multipart/form-data">
+            <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
             <p>You can receive notifications to email:<br/>
                 Sent to <select name="account">
                     <option value="">Disabled</option>
@@ -112,6 +118,7 @@
         {% if fbstatus.connected %}
         {% if fbstatus.crosspostEnabled %}
         <form action="/settings" method="post">
+            <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
             <div>
                 Facebook: <b>Enabled</b> &mdash;
                 <input type="hidden" name="page" value="facebook-disable"/>
@@ -120,6 +127,7 @@
         </form>
         {% else %}
         <form action="/settings" method="post">
+            <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
             <div>
                 Facebook: <b>Disabled</b> &mdash;
                 <input type="hidden" name="page" value="facebook-enable"/>
@@ -136,6 +144,7 @@
         Twitter</legend>
     {% if twitter_name is not empty %}
     <form action="/settings" method="post">
+        <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}" />
         <div>Twitter: <b>{{ twitter_name }}</b> &mdash;
             <input type="hidden" name="page" value="twitter-del"/>
             <input type="submit" class="Button" value="  Disable  "/>