Fix Markdown preview

thomiceli · Nov 1, 2024 · 825e031 · 825e031
1 parent 97b9fa1
commit 825e031
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 9 deletions.
diff --git a/internal/web/server.go b/internal/web/server.go
@@ -245,14 +245,13 @@ func NewServer(isDev bool, sessionsPath string) *Server {
 	// Web based routes
 	g1 := e.Group("")
 	{
-		if !dev {
-			g1.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
-				TokenLookup:    "form:_csrf,header:X-CSRF-Token",
-				CookiePath:     "/",
-				CookieHTTPOnly: true,
-				CookieSameSite: http.SameSiteStrictMode,
-			}))
-		}
+		g1.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
+			TokenLookup:    "form:_csrf,header:X-CSRF-Token",
+			CookiePath:     "/",
+			CookieHTTPOnly: true,
+			CookieSameSite: http.SameSiteStrictMode,
+		}))
+
 		g1.Use(csrfInit)
 		g1.GET("/", create, logged)
 		g1.POST("/", processCreate, logged)

diff --git a/public/editor.ts b/public/editor.ts
@@ -73,10 +73,14 @@ document.addEventListener("DOMContentLoaded", () => {
             } else {
                 const formData = new FormData();
                 formData.append('content', editor.state.doc.toString());
+                let csrf = document.querySelector<HTMLInputElement>('form#create input[name="_csrf"]').value
                 fetch(`${baseUrl}/preview`, {
                     method: 'POST',
                     credentials: 'same-origin',
-                    body: formData
+                    body: formData,
+                    headers: {
+                        'X-CSRF-Token': csrf
+                    }
                 }).then(r => r.text()).then(r => {
                     let divpreview = dom.querySelector("div.preview") as HTMLElement;
                     divpreview!.innerHTML = r;