* add CSRF protection to xhr requests

 * force ORM to use SQLITE WAL
 * add .editorconfig
 * cleanup a few things

1 files changed, 17 insertions, 4 deletions

diff --git a/backend.php b/backend.php
index 42fc5e9..0cbd6f4 100644
--- a/backend.php
+++ b/backend.php
@@ -27,6 +27,18 @@
 	$owner = $_SESSION["owner"] ?? "";
 	$op = $_REQUEST["op"] ?? "";
 
+	if (!empty($_SESSION['owner'])) {
+		$csrf_ignore = [ "cover", "download", "getpagination" ];
+
+		$csrf_token = $_POST['csrf_token'] ?? "";
+
+		if (!in_array($op, $csrf_ignore) && !validate_csrf($csrf_token)) {
+			header($_SERVER["SERVER_PROTOCOL"]." 401 Unauthorized");
+			echo "Unauthorized (CSRF)";
+			exit;
+		}
+	}
+
 	switch ($op) {
 	case "cover":
 		$id = (int) $_REQUEST["id"];
@@ -55,10 +67,6 @@
 		}
 		break;
 
-	case "getowner":
-		print json_encode(["owner" => $owner]);
-		break;
-
 	case "getinfo":
 		$id = (int) $_REQUEST["id"];
 
@@ -300,6 +308,11 @@
 		}
 		break;
 
+	case "logout":
+		logout_user();
+		print json_encode(["result" => "OK"]);
+		break;
+
 	default:
 		header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found");
 		echo "Method not found.";