diff options
| author | Sheogorath | 2018-05-25 18:19:31 +0200 |
|---|---|---|
| committer | Sheogorath | 2018-05-25 18:26:06 +0200 |
| commit | 70df29790a83db4abb40ed1e16cb05a3aa760672 (patch) | |
| tree | 0f3805604956f4dc93020f7af2a124136ed8084b /public/views | |
| parent | 9fd09a8dfb8c59a44e9b2b51658e9e638a855635 (diff) | |
Add token based security feature
In the current setup users could be tricked into deleting their data by
providing a malicious link like `[click me](/me/delete)`. This commit
prevents such an easy attack and need the user's deleteToken to get his
data deleted. In case someone requests his deletion by email you can
also ask him for this token.
We can add a GUI that shows it later on.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Diffstat (limited to 'public/views')
| -rw-r--r-- | public/views/index/body.ejs | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/public/views/index/body.ejs b/public/views/index/body.ejs index d4350540..f28ab11d 100644 --- a/public/views/index/body.ejs +++ b/public/views/index/body.ejs @@ -193,7 +193,7 @@ </div> <div class="modal-footer"> <button type="button" class="btn btn-default ui-delete-user-modal-cancel" data-dismiss="modal"><%= __('Cancel') %></button> - <a type="button" class="btn btn-danger" href="<%- url %>/me/delete"><%= __('Yes, do it!') %></a> + <a type="button" class="btn btn-danger" href="<%- url %>/me/delete/<%- deleteToken %>"><%= __('Yes, do it!') %></a> </div> </div> </div> |