summaryrefslogtreecommitdiff
path: root/public
diff options
context:
space:
mode:
authorSheogorath2018-05-25 18:19:31 +0200
committerSheogorath2018-05-25 18:26:06 +0200
commit70df29790a83db4abb40ed1e16cb05a3aa760672 (patch)
tree0f3805604956f4dc93020f7af2a124136ed8084b /public
parent9fd09a8dfb8c59a44e9b2b51658e9e638a855635 (diff)
Add token based security feature
In the current setup users could be tricked into deleting their data by providing a malicious link like `[click me](/me/delete)`. This commit prevents such an easy attack and need the user's deleteToken to get his data deleted. In case someone requests his deletion by email you can also ask him for this token. We can add a GUI that shows it later on. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Diffstat (limited to 'public')
-rw-r--r--public/views/index/body.ejs2
1 files changed, 1 insertions, 1 deletions
diff --git a/public/views/index/body.ejs b/public/views/index/body.ejs
index d4350540..f28ab11d 100644
--- a/public/views/index/body.ejs
+++ b/public/views/index/body.ejs
@@ -193,7 +193,7 @@
</div>
<div class="modal-footer">
<button type="button" class="btn btn-default ui-delete-user-modal-cancel" data-dismiss="modal"><%= __('Cancel') %></button>
- <a type="button" class="btn btn-danger" href="<%- url %>/me/delete"><%= __('Yes, do it!') %></a>
+ <a type="button" class="btn btn-danger" href="<%- url %>/me/delete/<%- deleteToken %>"><%= __('Yes, do it!') %></a>
</div>
</div>
</div>