From b8286c829a9c248624eb9e9867d7e23e5e7bdba2 Mon Sep 17 00:00:00 2001
From: dgtlmoon <dgtlmoon@gmail.com>
Date: Mon, 21 Mar 2022 22:40:11 +0100
Subject: [PATCH] Adding CSRF protection Disable during tests

---
 changedetectionio/__init__.py                   | 4 ++++
 changedetectionio/templates/edit.html           | 1 +
 changedetectionio/templates/import.html         | 1 +
 changedetectionio/templates/login.html          | 1 +
 changedetectionio/templates/scrub.html          | 1 +
 changedetectionio/templates/settings.html       | 1 +
 changedetectionio/templates/watch-overview.html | 1 +
 changedetectionio/tests/conftest.py             | 3 +++
 changedetectionio/tests/test_backend.py         | 1 +
 9 files changed, 14 insertions(+)

diff --git a/changedetectionio/__init__.py b/changedetectionio/__init__.py
index 860625870..f887c05cf 100644
--- a/changedetectionio/__init__.py
+++ b/changedetectionio/__init__.py
@@ -35,6 +35,7 @@ from flask import (
     url_for,
 )
 from flask_login import login_required
+from flask_wtf import CSRFProtect
 
 from changedetectionio import html_tools
 
@@ -72,6 +73,9 @@ app.config['LOGIN_DISABLED'] = False
 # Disables caching of the templates
 app.config['TEMPLATES_AUTO_RELOAD'] = True
 
+csrf = CSRFProtect()
+csrf.init_app(app)
+
 notification_debug_log=[]
 
 def init_app_secret(datastore_path):
diff --git a/changedetectionio/templates/edit.html b/changedetectionio/templates/edit.html
index 0f10c8fa1..74d41725c 100644
--- a/changedetectionio/templates/edit.html
+++ b/changedetectionio/templates/edit.html
@@ -19,6 +19,7 @@
     <div class="box-wrap inner">
         <form class="pure-form pure-form-stacked"
               action="{{ url_for('edit_page', uuid=uuid, next = request.args.get('next') ) }}" method="POST">
+             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
 
             <div class="tab-pane-inner" id="general">
                 <fieldset>
diff --git a/changedetectionio/templates/import.html b/changedetectionio/templates/import.html
index 943e580d6..e9376fc46 100644
--- a/changedetectionio/templates/import.html
+++ b/changedetectionio/templates/import.html
@@ -4,6 +4,7 @@
 <div class="edit-form">
      <div class="inner">
         <form class="pure-form pure-form-aligned" action="{{url_for('import_page')}}" method="POST">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             <fieldset class="pure-group">
               <legend>
                 Enter one URL per line, and optionally add tags for each URL after a space, delineated by comma (,):
diff --git a/changedetectionio/templates/login.html b/changedetectionio/templates/login.html
index 32259930d..2e24ddb4b 100644
--- a/changedetectionio/templates/login.html
+++ b/changedetectionio/templates/login.html
@@ -4,6 +4,7 @@
 <div class="login-form">
  <div class="inner">
     <form class="pure-form pure-form-stacked" action="{{url_for('login')}}" method="POST">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
         <fieldset>
             <div class="pure-control-group">
                 <label for="password">Password</label>
diff --git a/changedetectionio/templates/scrub.html b/changedetectionio/templates/scrub.html
index 25ddbf183..bd006b31c 100644
--- a/changedetectionio/templates/scrub.html
+++ b/changedetectionio/templates/scrub.html
@@ -4,6 +4,7 @@
 <div class="edit-form">
     <div class="box-wrap inner">
     <form class="pure-form pure-form-stacked" action="{{url_for('scrub_page')}}" method="POST">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
         <fieldset>
             <div class="pure-control-group">
                 This will remove all version snapshots/data, but keep your list of URLs. <br/>
diff --git a/changedetectionio/templates/settings.html b/changedetectionio/templates/settings.html
index db5b95954..129e5353b 100644
--- a/changedetectionio/templates/settings.html
+++ b/changedetectionio/templates/settings.html
@@ -18,6 +18,7 @@
     </div>
     <div class="box-wrap inner">
         <form class="pure-form pure-form-stacked settings" action="{{url_for('settings_page')}}" method="POST">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             <div class="tab-pane-inner" id="general">
                 <fieldset>
                     <div class="pure-control-group">
diff --git a/changedetectionio/templates/watch-overview.html b/changedetectionio/templates/watch-overview.html
index bf222dbfd..313c1bf55 100644
--- a/changedetectionio/templates/watch-overview.html
+++ b/changedetectionio/templates/watch-overview.html
@@ -5,6 +5,7 @@
 <div class="box">
 
     <form class="pure-form" action="{{ url_for('api_watch_add') }}" method="POST" id="new-watch-form">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
         <fieldset>
             <legend>Add a new change detection watch</legend>
                 {{ render_simple_field(form.url, placeholder="https://...", required=true) }}
diff --git a/changedetectionio/tests/conftest.py b/changedetectionio/tests/conftest.py
index aced3075c..98d4dd9ee 100644
--- a/changedetectionio/tests/conftest.py
+++ b/changedetectionio/tests/conftest.py
@@ -42,6 +42,9 @@ def app(request):
     cleanup(app_config['datastore_path'])
     datastore = store.ChangeDetectionStore(datastore_path=app_config['datastore_path'], include_default_watches=False)
     app = changedetection_app(app_config, datastore)
+
+    # Disable CSRF while running tests
+    app.config['WTF_CSRF_ENABLED'] = False
     app.config['STOP_THREADS'] = True
 
     def teardown():
diff --git a/changedetectionio/tests/test_backend.py b/changedetectionio/tests/test_backend.py
index b279251fe..ddd32751d 100644
--- a/changedetectionio/tests/test_backend.py
+++ b/changedetectionio/tests/test_backend.py
@@ -25,6 +25,7 @@ def test_check_basic_change_detection_functionality(client, live_server):
         data={"urls": url_for('test_endpoint', _external=True)},
         follow_redirects=True
     )
+
     assert b"1 Imported" in res.data
 
     time.sleep(sleep_time_for_fetch_thread)