src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: gate admin routes against cross-origin CSRF

Browse Source
This commit is contained in:
Linus Rath
2026-05-18 13:21:01 +02:00
parent b299a0b602
commit c2eb2c081b
16 changed files with 82 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/admin/config/route.ts
+4 -4
View File
@@ -20,9 +20,9 @@ const SENSITIVE_PLACEHOLDERS = new Set(['your-secret-key-here']);
* the server so that an XSS or session-theft can't lift them in one
* request and forge admin/user session cookies offline.
*/
export async function GET() {
export async function GET(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
await configManager.ensureLoaded();
@@ -54,7 +54,7 @@ export async function GET() {
*/
export async function PATCH(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const ip = getClientIP(request);
@@ -109,7 +109,7 @@ export async function PATCH(request: NextRequest) {
*/
export async function DELETE(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const ip = getClientIP(request);