Check CSRF Token at POST /authorize_follow

2020-06-04 14:43:52 +09:00 · 2020-06-04 14:43:52 +09:00 · a34905dfda
commit a34905dfda
parent 4c5d798ed4
1 changed files with 1 additions and 0 deletions
--- a/blueprints/admin.py
+++ b/blueprints/admin.py
@ -639,6 +639,7 @@ def authorize_follow():
            )
        )

+    csrf.protect()
    actor = get_actor_url(request.form.get("profile"))
    if not actor:
        abort(500)