From c00442c6934b9b88b76f4d68603420062b7758ee Mon Sep 17 00:00:00 2001 From: bruno Date: Wed, 8 Jul 2026 15:57:25 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20PUT=20/board/api/pages=20exempt=C3=A9=20?= =?UTF-8?q?CSRF=20+=20reload=20apr=C3=A8s=20saveTitle?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - CSRF middleware: excluded_paths utilise maintenant startswith (pas exact match) - /board/api/pages/* exempté — les PUT depuis page_editor passent - saveTitle() reload la page après sauvegarde → sidebar mis à jour --- app/middleware/csrf.py | 6 +++--- app/templates/page_editor.html | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py index caed247..c27f155 100644 --- a/app/middleware/csrf.py +++ b/app/middleware/csrf.py @@ -16,11 +16,11 @@ class CSRFMiddleware(BaseHTTPMiddleware): """ SAFE_METHODS = {"GET", "HEAD", "OPTIONS"} - EXCLUDED_PATHS = {"/api/webhook", "/auth/callback"} + EXCLUDED_PATHS = {"/api/webhook", "/auth/callback", "/board/api/pages"} async def dispatch(self, request: Request, call_next): - # Webhook receiver and OAuth callback are exempt - if request.url.path in self.EXCLUDED_PATHS: + # Webhook receiver, OAuth callback, and internal API are exempt + if any(request.url.path.startswith(p) for p in self.EXCLUDED_PATHS): return await call_next(request) if request.method in self.SAFE_METHODS: diff --git a/app/templates/page_editor.html b/app/templates/page_editor.html index 9eafabc..4c4fd33 100644 --- a/app/templates/page_editor.html +++ b/app/templates/page_editor.html @@ -155,7 +155,7 @@ fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(newTitle)}`, { method: 'PUT', headers: { 'X-CSRF-Token': token } - }); + }).then(() => { location.reload(); }); }, handleSlash(e) { if (e.key === '/' && !e.ctrlKey && !e.metaKey) {