Merge pull request #297 from wheels-dev/fix/authenticity-token

zainforbjs · web-flow · commit 2cf38e0740bc · 2026-02-17T17:32:55.000+05:00
Fix CSRF token missing on all POST forms
diff --git a/app/views/admin/AdminController/blog.cfm b/app/views/admin/AdminController/blog.cfm
@@ -8,9 +8,9 @@
                     </div>
                     <div class="d-flex gap-2">
                         <a href="#urlFor(route='blog-create')#" class="btn bg--primary text-white mb-3">Create New Article</a>
-                        <form id="bulkRejectForm" hx-post="/admin/bulkReject" hx-target="##responseTable" hx-swap="innerHTML"></form>
+                        <form id="bulkRejectForm" hx-post="/admin/bulkReject" hx-target="##responseTable" hx-swap="innerHTML">#authenticityTokenField()#</form>
                         <button id="bulkRejectBtn" class="btn btn-ligh border solid mb-3">Reject Selected</button>
-                        <form id="bulkForm" hx-post="/admin/bulkApprove" hx-target="##responseTable" hx-swap="innerHTML"></form>
+                        <form id="bulkForm" hx-post="/admin/bulkApprove" hx-target="##responseTable" hx-swap="innerHTML">#authenticityTokenField()#</form>
                         <button id="bulkApproveBtn" class="btn bg--primary text-white mb-3">Approve Selected</button>
                     </div>
                 </div>
diff --git a/app/views/admin/AdminController/editBlog.cfm b/app/views/admin/AdminController/editBlog.cfm
@@ -13,6 +13,7 @@
                         </div>
                     </cfif>
                     <form id="blogForm" method="post" action='/admin/blog/blogUpdate/#blog.id#' class="needs-validation" novalidate hx-validate="true" enctype="multipart/form-data" onsubmit="document.getElementById('editLoader').style.display = 'block';">
+                        #authenticityTokenField()#
                         <input type="hidden" name="_method" value="#isEdit ? 'PUT' : 'POST'#">
                         <input class="form-control" type="hidden" name="id" id="id" value="#isEdit ? blog.id : ''#">
     
diff --git a/app/views/admin/CategoriesController/add.cfm b/app/views/admin/CategoriesController/add.cfm
@@ -24,6 +24,7 @@
     </div>
     <div class="row">
         <form class="row g-3 mb-6 needs-validation" id="categoryForm" novalidate hx-post="/admin/category/save" hx-target="body" hx-validate="true">
+            #authenticityTokenField()#
             <input name="id" type="hidden" id="id" value="#id#">
 
             <div class="col-sm-6 col-md-6 col-lg-12 mb-3">
diff --git a/app/views/admin/FeatureController/addFeature.cfm b/app/views/admin/FeatureController/addFeature.cfm
@@ -25,6 +25,7 @@
     </div>
     <div class="row">
         <form class="row g-3 mb-6 needs-validation" id="featureForm" novalidate action="/admin/feature/store" method="post" hx-validate="true">
+            #authenticityTokenField()#
             <input name="id" type="hidden" id="id" value="#id#">
 
             <div class="col-sm-6 col-md-6 mb-3">
diff --git a/app/views/admin/NewsletterController/index.cfm b/app/views/admin/NewsletterController/index.cfm
@@ -155,6 +155,7 @@
                 </div>
                 <div class="modal-body">
                     <form hx-post="/admin/newsletter/send" hx-swap="none">
+                        #authenticityTokenField()#
                         <div class="mb-3">
                             <label for="subject" class="form-label mb-2">Newsletter Subject</label>
                             <input type="text" class="form-control" id="subject" name="subject" placeholder="Enter newsletter subject" required>
diff --git a/app/views/admin/RolesController/add.cfm b/app/views/admin/RolesController/add.cfm
@@ -23,6 +23,7 @@
     </div>
     <div class="row">
         <form class="row g-3 mb-6 needs-validation" id="RoleForm" novalidate hx-post="/admin/Role/save" hx-target="body" hx-validate="true">
+            #authenticityTokenField()#
             <input name="id" type="hidden" id="id" value="#id#">
 
             <div class="col-sm-6 col-md-6 mb-3">
diff --git a/app/views/admin/UserController/addUser.cfm b/app/views/admin/UserController/addUser.cfm
@@ -35,6 +35,7 @@
     </div>
     <div class="row">
         <form class="row g-3 mb-6 needs-validation" id="userForm" novalidate action="/admin/user/store" method="post" hx-validate="true">
+            #authenticityTokenField()#
             <input name="id" type="hidden" id="id" value="#id#">
 
             <div class="col-sm-6 col-md-6 mb-3">
diff --git a/app/views/admin/UserController/changePassword.cfm b/app/views/admin/UserController/changePassword.cfm
@@ -5,6 +5,7 @@
                 <h1 class="fs-24 mb-0 fw-bold text--secondary text-center">Change Password</h1>
 
                 <form class="pt-3 px-1 needs-validation" id="changePasswordForm" novalidate hx-post="/admin/user/update-Password" hx-validate="true">
+                    <cfoutput>#authenticityTokenField()#</cfoutput>
                     <div class="mb-3">
                         <div class="bg--input d-flex align-items-center px-3 py-3 rounded-4 border gap-2">
                             <svg width="20" height="20" class="flex-shrink-0" viewBox="0 0 24 24" fill="none"
diff --git a/app/views/admin/UserController/profile.cfm b/app/views/admin/UserController/profile.cfm
@@ -24,6 +24,7 @@
                 
                 
                 <form class="pt-3 px-1 needs-validation" id="userForm" novalidate hx-post="/admin/user/store" hx-validate="true" enctype="multipart/form-data">
+                    #authenticityTokenField()#
                     <input name="id" type="hidden" id="id" value="#id#">
 
                     <div class="mb-3">
diff --git a/app/views/admin/UserController/updateProfilePic.cfm b/app/views/admin/UserController/updateProfilePic.cfm
@@ -13,6 +13,7 @@
                     </cfoutput>
                 </div>
                 <form class="pt-3 px-1 needs-validation" id="profilePicForm" enctype="multipart/form-data" novalidate hx-post="/admin/user/upload-profile-pic" hx-validate="true">
+                    <cfoutput>#authenticityTokenField()#</cfoutput>
                     <div class="mb-3">
                         <label for="formFile" class="form-label">Profile Picture</label>
                         <input type="file" id="imageInput" class="form-control" name="profilePic" accept="image/*" required>
diff --git a/app/views/admin/emailtemplatescontroller/edit.cfm b/app/views/admin/emailtemplatescontroller/edit.cfm
@@ -9,6 +9,7 @@
     </div>
     <div class="row">
         <form class="row g-3 mb-6 needs-validation" id="emailForm" novalidate method="POST" action="#urlFor(route="adminemail-save")#">
+            #authenticityTokenField()#
             <input name="id" type="hidden" id="id" value="#email.id#">
             <input name="title" type="hidden" id="title" value="#email.title#">
 
diff --git a/app/views/admin/settingscontroller/editContributors.cfm b/app/views/admin/settingscontroller/editContributors.cfm
@@ -9,6 +9,7 @@
     </div>
     <div class="row">
         <form class="row g-3 mb-6 needs-validation" id="emailForm" novalidate method="POST" action="#urlFor(route="adminStore-contributors")#">
+            #authenticityTokenField()#
             <input name="id" type="hidden" id="id" value="#contributor.id#">
 
             <div class="col-sm-6 col-md-6 mb-3">
diff --git a/app/views/admin/settingscontroller/index.cfm b/app/views/admin/settingscontroller/index.cfm
@@ -26,6 +26,7 @@
                     <div class="mb-4">
                         <h6 class="mb-3">Slack Community</h6>
                         <form hx-post="/admin/settings/updateSlackInvite" hx-swap="none">
+                            #authenticityTokenField()#
                             <div class="row g-3">
                                 <div class="col-md-8">
                                     <input type="text" class="form-control" name="slackInviteLink" 
@@ -47,6 +48,7 @@
                     <div class="mb-4">
                         <h6 class="mb-3">Wheels Contributor</h6>
                         <form hx-post="/admin/settings/updateContributorApi" hx-swap="none">
+                            #authenticityTokenField()#
                             <div class="row g-3">
                                 <div class="col-md-8">
                                     <input type="text" class="form-control" name="wheelsContributorLink" 
diff --git a/app/views/web/AuthController/forgotPassword.cfm b/app/views/web/AuthController/forgotPassword.cfm
@@ -14,6 +14,7 @@
 
                 <form hx-boost="true" class="pt-4 needs-validation" id="forgotPasswordForm" novalidate
                     hx-post="/auth/send-reset-link" hx-swap="none" aria-label="Forgot Password Form">
+                    <cfoutput>#authenticityTokenField()#</cfoutput>
 
                     <div class="mb-3">
                         <div class="bg--input d-flex align-items-center px-3 py-3 rounded-4 border gap-2 transition-all hover:border-primary">
diff --git a/app/views/web/AuthController/login.cfm b/app/views/web/AuthController/login.cfm
@@ -14,6 +14,9 @@
 
                 <form hx-boost="true" class="pt-4 needs-validation" id="loginForm" novalidate
                     hx-post="/auth/authenticate" hx-swap="none" aria-label="Login Form">
+                    <cfoutput>
+                        #authenticityTokenField()#
+                    </cfoutput>
 
                     <div class="mb-3">
                         <div class="bg--input d-flex align-items-center px-3 py-3 rounded-4 border gap-2 transition-all hover:border-primary">
diff --git a/app/views/web/AuthController/profile.cfm b/app/views/web/AuthController/profile.cfm
@@ -11,6 +11,7 @@
                 </div>
 
                 <form class="pt-3 px-1 h-70vh overflow-y-auto no-scrollbar needs-validation" id="updateProfileForm" novalidate>
+                    <cfoutput>#authenticityTokenField()#</cfoutput>
                     <div class="mb-3">
                         <label for="firstName" class="form-label fs-14 fw-medium">First name</label>
                         <input type="text" placeholder="Enter your firstname" class="form-control fs-14" id="firstName" required>
diff --git a/app/views/web/AuthController/register.cfm b/app/views/web/AuthController/register.cfm
@@ -45,6 +45,7 @@
 
                     <form class="pt-3 needs-validation" id="registrationForm" novalidate hx-post="/auth/store"
                         hx-validate="true">
+                        <cfoutput>#authenticityTokenField()#</cfoutput>
                         <div class="row">
                             <div class="col-md-6 mb-3">
                                 <div class="bg--input d-flex align-items-center px-3 py-3 rounded-4 border gap-2">
diff --git a/app/views/web/AuthController/reset.cfm b/app/views/web/AuthController/reset.cfm
@@ -11,6 +11,7 @@
                 </div>
 
                 <form class="pt-3 px-1 needs-validation" id="loginForm" novalidate>
+                    <cfoutput>#authenticityTokenField()#</cfoutput>
                     <div class="mb-3">
                         <label for="password" class="form-label fs-14 fw-medium">Password</label>
                         <input type="password" placeholder="Enter your password" class="form-control fs-14"
diff --git a/app/views/web/AuthController/resetPassword.cfm b/app/views/web/AuthController/resetPassword.cfm
@@ -14,6 +14,7 @@
 
                 <form hx-validate="true" class="pt-4 needs-validation" id="forgotPasswordForm" novalidate
                     hx-post="/auth/update-password" hx-swap="none" aria-label="Forgot Password Form">
+                    <cfoutput>#authenticityTokenField()#</cfoutput>
 
                     <div class="mb-3">
                         <div class="bg--input d-flex align-items-center px-3 py-3 rounded-4 border gap-2 transition-all hover:border-primary">
diff --git a/app/views/web/BlogController/create.cfm b/app/views/web/BlogController/create.cfm
@@ -13,6 +13,7 @@
                         </div>
                     </cfif>
                     <form id="blogForm" hx-post="#isEdit ? '/blog/update/#blog.id#' : '/blog/store'#" hx-swap="none" class="needs-validation" novalidate hx-validate="true" enctype="multipart/form-data">
+                        #authenticityTokenField()#
                         <input type="hidden" name="_method" value="#isEdit ? 'PUT' : 'POST'#">
                         <input class="form-control" type="hidden" name="id" id="id" value="#isEdit ? blog.id : ''#">
                         <input type="hidden" name="content" id="content" value="">
diff --git a/app/views/web/TestimonialController/new.cfm b/app/views/web/TestimonialController/new.cfm
@@ -13,6 +13,7 @@
                     hx-encoding="multipart/form-data"
                     hx-on="htmx:afterOnLoad: handleTestimonialResponse(event)"
                     onsubmit="if (this.checkValidity()) { this.querySelector('button[type=submit]').disabled = true; } else { event.preventDefault(); event.stopPropagation(); this.classList.add('was-validated'); }">
+                    #authenticityTokenField()#
                 </cfoutput>
                     <div id="form-messages"></div>
                     <div class="text-end">
