CSRF more mod pages

16 files changed, 24 insertions, 11 deletions

diff --git a/templates/mod/ban_appeals.html b/templates/mod/ban_appeals.html
index f43b7db5..23eced12 100644
--- a/templates/mod/ban_appeals.html
+++ b/templates/mod/ban_appeals.html
@@ -1,6 +1,7 @@
 {% for ban in ban_appeals %}
 
 <form action="" method="post" style="margin: 10px 0">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table style="margin: 5px 0">
 		<tr>
 			<th>{% trans 'Status' %}</th>
diff --git a/templates/mod/ban_list.html b/templates/mod/ban_list.html
index b41cef28..97c02029 100644
--- a/templates/mod/ban_list.html
+++ b/templates/mod/ban_list.html
@@ -1,7 +1,8 @@
 {% if bans|count == 0 %}
 	<p style="text-align:center" class="unimportant">({% trans 'There are no active bans.' %})</p>
 {% else %}
-	<form action="" method="post">
+	<form action="?/bans" method="post">
+		<input type="hidden" name="token" value="{{ token }}">
 		<table class="mod" style="width:100%">
 			<tr>
 				<th>{% trans 'IP address/mask' %}</th>
diff --git a/templates/mod/board.html b/templates/mod/board.html
index 0775e421..4da597a7 100644
--- a/templates/mod/board.html
+++ b/templates/mod/board.html
@@ -5,6 +5,7 @@
 {% endif %}
 
 <form action="{{ action }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>{% trans 'URI' %}</th>
diff --git a/templates/mod/config-editor-php.html b/templates/mod/config-editor-php.html
index 4f76b5dd..0c1a3a09 100644
--- a/templates/mod/config-editor-php.html
+++ b/templates/mod/config-editor-php.html
@@ -21,6 +21,7 @@
 	
 	
 	{% if not readonly %}<form method="post" action="">{% endif %}
+		<input type="hidden" name="token" value="{{ token }}">
 		<textarea name="code" id="code" style="margin:auto;width:100%;height:500px{% if readonly %};background:#eee" readonly{% else %}"{% endif %}>
 		{{ php }}
 		</textarea>
diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html
index 4f4cba93..411d55e6 100644
--- a/templates/mod/config-editor.html
+++ b/templates/mod/config-editor.html
@@ -14,6 +14,7 @@
 	</ul>
 {% endif %}
 <form method="post" action="">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table class="mod config-editor">
 		<tr>
 			<th class="minimal">{% trans 'Name' %}</th>
diff --git a/templates/mod/dashboard.html b/templates/mod/dashboard.html
index 916f0c03..7b907533 100644
--- a/templates/mod/dashboard.html
+++ b/templates/mod/dashboard.html
@@ -164,7 +164,7 @@
 	<legend>{% trans 'User account' %}</legend>
 	
 	<ul>
-		<li><a href="?/logout">{% trans 'Logout' %}</a></li>
+		<li><a href="?/logout/{{ logout_token }}">{% trans 'Logout' %}</a></li>
 	</ul>
 </fieldset>
 
diff --git a/templates/mod/new_pm.html b/templates/mod/new_pm.html
index 3fd78ac6..605b0973 100644
--- a/templates/mod/new_pm.html
+++ b/templates/mod/new_pm.html
@@ -1,4 +1,5 @@
 <form action="?/new_PM/{{ username|e }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>To</th>
diff --git a/templates/mod/news.html b/templates/mod/news.html
index b0335e0a..510d60ce 100644
--- a/templates/mod/news.html
+++ b/templates/mod/news.html
@@ -2,6 +2,7 @@
 	<fieldset>
 		<legend>{% trans 'New post' %}</legend>
 		<form style="margin:0" action="" method="post">
+			<input type="hidden" name="token" value="{{ token }}">
 			<table>
 				<tr>
 					<th>
@@ -39,7 +40,7 @@
 	<div class="ban">
 		{% if mod|hasPermission(config.mod.news_delete) %}
 			<span style="float:right;padding:2px">
-				<a class="unimportant" href="?/news/delete/{{ post.id }}">[{% trans 'delete' %}]</a>
+				<a class="unimportant" href="?/news/delete/{{ post.id }}/{{ post.delete_token }}">[{% trans 'delete' %}]</a>
 			</span>
 		{% endif %}
 		<h2 id="{{ post.id }}">
diff --git a/templates/mod/noticeboard.html b/templates/mod/noticeboard.html
index 463b8430..fc2e0aef 100644
--- a/templates/mod/noticeboard.html
+++ b/templates/mod/noticeboard.html
@@ -1,7 +1,8 @@
 {% if mod|hasPermission(config.mod.noticeboard_post) %}
 	<fieldset>
 		<legend>{% trans 'New post' %}</legend>
-		<form style="margin:0" action="" method="post">
+		<form style="margin:0" action="?/noticeboard" method="post">
+			<input type="hidden" name="token" value="{{ token }}">
 			<table>
 				<tr>
 					<th>{% trans 'Name' %}</th>
@@ -27,7 +28,7 @@
 	<div class="ban">
 		{% if mod|hasPermission(config.mod.noticeboard_delete) %}
 			<span style="float:right;padding:2px">
-				<a class="unimportant" href="?/noticeboard/delete/{{ post.id }}">[{% trans 'delete' %}]</a>
+				<a class="unimportant" href="?/noticeboard/delete/{{ post.id }}/{{ post.delete_token }}">[{% trans 'delete' %}]</a>
 			</span>
 		{% endif %}
 		<h2 id="{{ post.id }}">
diff --git a/templates/mod/rebuild.html b/templates/mod/rebuild.html
index 7c6b28ba..81d1ead3 100644
--- a/templates/mod/rebuild.html
+++ b/templates/mod/rebuild.html
@@ -1,4 +1,5 @@
 <form style="width:300px;margin:auto" action="?/rebuild" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<ul id="rebuild">
 		<li style="margin-bottom:8px">
 			<input type="checkbox" name="rebuild_all" id="rebuild_all" onchange="toggleall(this.checked)"> 
diff --git a/templates/mod/report.html b/templates/mod/report.html
index 9c8463ed..b5392d5b 100644
--- a/templates/mod/report.html
+++ b/templates/mod/report.html
@@ -13,13 +13,13 @@
 	{% if mod|hasPermission(config.mod.report_dismiss, report.board) or mod|hasPermission(config.mod.report_dismiss_ip, report.board) %}
 		<hr>
 		{% if mod|hasPermission(config.mod.report_dismiss, report.board) %}
-			<a title="{% trans 'Discard abuse report' %}" href="?/reports/{{ report.id }}/dismiss">Dismiss</a>
+			<a title="{% trans 'Discard abuse report' %}" href="?/reports/{{ report.id }}/dismiss/{{ token }}">Dismiss</a>
 		{% endif %}
 		{% if mod|hasPermission(config.mod.report_dismiss_ip, report.board) %}
 			{% if mod|hasPermission(config.mod.report_dismiss, report.board) %}
 			 | 
 			{% endif %}
-			<a title="{% trans 'Discard all abuse reports by this IP address' %}" href="?/reports/{{ report.id }}/dismissall">Dismiss+</a>
+			<a title="{% trans 'Discard all abuse reports by this IP address' %}" href="?/reports/{{ report.id }}/dismissall/{{ token_all }}">Dismiss+</a>
 		{% endif %}
 	{% endif %}
 </div>
diff --git a/templates/mod/theme_config.html b/templates/mod/theme_config.html
index d85b5df1..d82a1f14 100644
--- a/templates/mod/theme_config.html
+++ b/templates/mod/theme_config.html
@@ -1,4 +1,5 @@
 <form action="" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	{% if not config %}
 		<p style="text-align:center" class="unimportant">(No configuration required.)</p>
 	{% else %}
diff --git a/templates/mod/themes.html b/templates/mod/themes.html
index b596826d..b230bc48 100644
--- a/templates/mod/themes.html
+++ b/templates/mod/themes.html
@@ -28,8 +28,8 @@
 							{% if theme_name in themes_in_use %}{% trans 'Reconfigure' %}{% else %}{% trans 'Install' %}{% endif %}
 						</a></li>
 						{% if theme_name in themes_in_use %}
-							<li><a href="?/themes/{{ theme_name }}/rebuild">{% trans 'Rebuild' %}</a></li>
-							<li><a href="?/themes/{{ theme_name }}/uninstall" onclick="return confirm('Are you sure you want to uninstall this theme?');">{% trans 'Uninstall' %}</a></li>
+							<li><a href="?/themes/{{ theme_name }}/rebuild/{{ theme.rebuild_token }}">{% trans 'Rebuild' %}</a></li>
+							<li><a href="?/themes/{{ theme_name }}/uninstall/{{ theme.uninstall_token }}" onclick="return confirm('Are you sure you want to uninstall this theme?');">{% trans 'Uninstall' %}</a></li>
 						{% endif %}
 					</ul></td>
 				</tr>
diff --git a/templates/mod/user.html b/templates/mod/user.html
index 89240824..08598fe5 100644
--- a/templates/mod/user.html
+++ b/templates/mod/user.html
@@ -5,6 +5,7 @@
 {% endif %}
 
 <form action="{{ action }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>{% trans 'Username' %}</th>
diff --git a/templates/mod/users.html b/templates/mod/users.html
index b4c666e1..6f42ce2a 100644
--- a/templates/mod/users.html
+++ b/templates/mod/users.html
@@ -48,10 +48,10 @@
 			{% endif %}
 			<td>
 				{% if mod|hasPermission(config.mod.promoteusers) and user.type < constant(config.mod.groups[0:-1]|last) %}
-					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote" title="{% trans 'Promote' %}">&#9650;</a> 
+					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote/{{ user.promote_token }}" title="{% trans 'Promote' %}">&#9650;</a> 
 				{% endif %}
 				{% if mod|hasPermission(config.mod.promoteusers) and user.type > constant(config.mod.groups|first) %}
-					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote" title="{% trans 'Demote' %}"{% if mod.id == user.id %} onclick="return confirm('{% trans 'Are you sure you want to demote yourself?' %}')"{% endif %}>&#9660;</a> 
+					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote/{{ user.demote_token }}" title="{% trans 'Demote' %}"{% if mod.id == user.id %} onclick="return confirm('{% trans 'Are you sure you want to demote yourself?' %}')"{% endif %}>&#9660;</a> 
 				{% endif %}
 				{% if mod|hasPermission(config.mod.modlog) %}
 					<a class="unimportant" style="margin-left:5px;float:right" href="?/log:{{ user.username|e }}">[{% trans 'log' %}]</a> 
diff --git a/templates/mod/view_ip.html b/templates/mod/view_ip.html
index f73c5d5a..1c1c7fa6 100644
--- a/templates/mod/view_ip.html
+++ b/templates/mod/view_ip.html
@@ -57,6 +57,7 @@
 		
 		{% if mod|hasPermission(config.mod.create_notes) %}
 			<form action="" method="post" style="margin:0">
+				<input type="hidden" name="token" value="{{ security_token }}">
 				<table>
 					<tr>
 						<th>{% trans 'Staff' %}</th>
@@ -87,6 +88,7 @@
 		
 		{% for ban in bans %}
 			<form action="" method="post" style="text-align:center">
+				<input type="hidden" name="token" value="{{ security_token }}">
 				<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px">
 					<tr>
 						<th>{% trans 'Status' %}</th>