mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-11 22:07:49 -04:00
Inverle
6bd14a6121
HTML injections outside of a form with a `_csrf` field set, could instead refer to the CSRF token form with a payload such as: ```html <button form="post-csrf" formaction="./i/?c=auth&a=logout" formmethod="post">Continue reading</button> ``` While the `post-csrf` form is useful for reducing the amount of code needed (no need to repeat the `_csrf` field in forms), I don't think it's worth the added security risk.