- backend: require CSRF token to be passed via POST

- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST

1 files changed, 1 insertions, 1 deletions

diff --git a/backend.php b/backend.php
index e65ce1b94..1bbeec2bd 100644
--- a/backend.php
+++ b/backend.php
@@ -20,7 +20,7 @@
 		return;
 	}
 
-	@$csrf_token = $_REQUEST['csrf_token'];
+	@$csrf_token = $_POST['csrf_token'];
 
 	require_once "autoload.php";
 	require_once "sessions.php";