- backend: require CSRF token to be passed via POST

- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST

3 files changed, 39 insertions, 35 deletions

diff --git a/js/App.js b/js/App.js
index 2bc2020bb..1bf4ed881 100644
--- a/js/App.js
+++ b/js/App.js
@@ -126,7 +126,33 @@ const App = {
 				return callOriginal(options);
 			}
 		);
-	},
+   },
+   postOpenWindow: function(target, params) {
+      const w = window.open("");
+
+		if (w) {
+			w.opener = null;
+
+			const form = document.createElement("form");
+
+			form.setAttribute("method", "post");
+			form.setAttribute("action", App.getInitParam("self_url_prefix") + "/" + target);
+
+			for (const [k,v] of Object.entries(params)) {
+				const field = document.createElement("input");
+
+				field.setAttribute("name", k);
+				field.setAttribute("value", v);
+				field.setAttribute("type", "hidden");
+
+				form.appendChild(field);
+			}
+
+			w.document.body.appendChild(form);
+			form.submit();
+		}
+
+   },
 	urlParam: function(param) {
 		return String(window.location.href).parseQuery()[param];
 	},
@@ -986,8 +1012,11 @@ const App = {
          };
          this.hotkey_actions["feed_debug_update"] = () => {
             if (!Feeds.activeIsCat() && parseInt(Feeds.getActive()) > 0) {
-               window.open("backend.php?op=feeds&method=update_debugger&feed_id=" + Feeds.getActive() +
-                  "&csrf_token=" + this.getInitParam("csrf_token"));
+               //window.open("backend.php?op=feeds&method=update_debugger&feed_id=" + Feeds.getActive());
+
+               /* global __csrf_token */
+               App.postOpenWindow("backend.php", {op: "feeds", method: "update_debugger", feed_id: Feeds.getActive(), csrf_token: __csrf_token});
+
             } else {
                alert("You can't debug this kind of feed.");
             }
diff --git a/js/Article.js b/js/Article.js
index e2284b190..174015a61 100644
--- a/js/Article.js
+++ b/js/Article.js
@@ -131,37 +131,11 @@ const Article = {
 		});
 	},
 	openInNewWindow: function (id) {
+		/* global __csrf_token */
+		App.postOpenWindow("backend.php",
+			{ "op": "article", "method": "redirect", "id": id, "csrf_token": __csrf_token });
 
-		const w = window.open("");
-
-		if (w) {
-			w.opener = null;
-
-			const form = document.createElement("form");
-
-			form.setAttribute("method", "post");
-			form.setAttribute("action", App.getInitParam("self_url_prefix") + "/backend.php");
-
-			/* global __csrf_token */
-
-			const params = { "op": "article", "method": "redirect", "id": id, "csrf_token": __csrf_token };
-
-			for (const [k,v] of Object.entries(params)) {
-				const field = document.createElement("input");
-
-				field.setAttribute("name", k);
-				field.setAttribute("value", v);
-				field.setAttribute("type", "hidden");
-
-				form.appendChild(field);
-			}
-
-			w.document.body.appendChild(form);
-			form.submit();
-
-			Headlines.toggleUnread(id, 0);
-		}
-
+		Headlines.toggleUnread(id, 0);
 	},
 	render: function (article) {
 		App.cleanupMemory("content-insert");
diff --git a/js/FeedTree.js b/js/FeedTree.js
index 74c29d2f7..c61d8a50f 100755
--- a/js/FeedTree.js
+++ b/js/FeedTree.js
@@ -101,8 +101,9 @@ define(["dojo/_base/declare", "dojo/dom-construct", "dojo/_base/array", "dojo/co
 					menu.addChild(new dijit.MenuItem({
 						label: __("Debug feed"),
 						onClick: function() {
-							window.open("backend.php?op=feeds&method=update_debugger&feed_id=" + this.getParent().row_id +
-								"&csrf_token=" + App.getInitParam("csrf_token"));
+							/* global __csrf_token */
+							App.postOpenWindow("backend.php", {op: "feeds", method: "update_debugger",
+								feed_id: this.getParent().row_id, csrf_token: __csrf_token});
 						}}));
 				}