Mirrored_Repos/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2025-11-05 07:02:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Check user_id as part of validating CSRF tokens

Browse Source
This commit is contained in:
Omar Roth
2018-11-08 00:29:20 -06:00
parent b9c29bf537
commit 1ff8579575
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/invidious.cr
View File

@@ -1429,7 +1429,7 @@ post "/delete_account" do |env|
token = env.params.body["token"]?
begin
validate_response(challenge, token, "delete_account", HMAC_KEY)
validate_response(challenge, token, user.email, "delete_account", HMAC_KEY)
rescue ex
error_message = ex.message
next templated "error"
@@ -1474,7 +1474,7 @@ post "/clear_watch_history" do |env|
token = env.params.body["token"]?
begin
validate_response(challenge, token, "clear_watch_history", HMAC_KEY)
validate_response(challenge, token, user.email, "clear_watch_history", HMAC_KEY)
rescue ex
error_message = ex.message
next templated "error"