Check CSRF Token at POST /authorize_follow

2020-06-04 14:43:52 +09:00
parent 4c5d798ed4
commit a34905dfda
1 changed files with 1 additions and 0 deletions
--- a/blueprints/admin.py
+++ b/blueprints/admin.py
@@ -639,6 +639,7 @@ def authorize_follow():
            )
        )

+    csrf.protect()
    actor = get_actor_url(request.form.get("profile"))
    if not actor:
        abort(500)