srizan/hctv
1
0
Fork 0
mirror of https://github.com/SrIzan10/hctv.git synced 2026-06-06 00:56:56 +00:00
Code Issues Packages Projects Releases 5 Wiki Activity

fix(admin): remove csrf checks

Browse Source
This commit is contained in:
Izan Gil
2026-02-21 17:01:35 +01:00
parent ed1608b8e3
commit a96939684b
4 changed files with 0 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/web/src/app/(ui)/(protected)/api/admin/channels/route.ts
View File

@@ -1,5 +1,4 @@
import { validateRequest } from '@/lib/auth/validate';
import { verifySameOrigin } from '@/lib/auth/csrf';
import { AdminAuditAction, prisma } from '@hctv/db';
import { NextRequest } from 'next/server';
@@ -48,11 +47,6 @@ export async function POST(request: NextRequest) {
return new Response('Forbidden', { status: 403 });
}
const csrfError = verifySameOrigin(request);
if (csrfError) {
return csrfError;
}
let body: {
channelId: string;
action: 'restrict' | 'unrestrict';

6
apps/web/src/app/(ui)/(protected)/api/admin/reports/route.ts
View File

@@ -1,5 +1,4 @@
import { validateRequest } from '@/lib/auth/validate';
import { verifySameOrigin } from '@/lib/auth/csrf';
import {
AdminAuditAction,
ChatModerationAction,
@@ -97,11 +96,6 @@ export async function POST(request: NextRequest) {
return new Response('Forbidden', { status: 403 });
}
const csrfError = verifySameOrigin(request);
if (csrfError) {
return csrfError;
}
let body: {
reportId?: string;
action?:

6
apps/web/src/app/(ui)/(protected)/api/admin/users/route.ts
View File

@@ -1,5 +1,4 @@
import { validateRequest } from '@/lib/auth/validate';
import { verifySameOrigin } from '@/lib/auth/csrf';
import { AdminAuditAction, prisma } from '@hctv/db';
import { NextRequest } from 'next/server';
@@ -38,11 +37,6 @@ export async function POST(request: NextRequest) {
return new Response('Forbidden', { status: 403 });
}
const csrfError = verifySameOrigin(request);
if (csrfError) {
return csrfError;
}
let body: {
userId: string;
action: 'ban' | 'unban' | 'promote' | 'demote';

16
apps/web/src/lib/auth/csrf.ts
View File

@@ -1,16 +0,0 @@
import { NextRequest } from 'next/server';
const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
export function verifySameOrigin(request: NextRequest): Response | null {
if (SAFE_METHODS.has(request.method)) {
return null;
}
const origin = request.headers.get('origin');
if (!origin || origin !== request.nextUrl.origin) {
return new Response('Forbidden', { status: 403 });
}
return null;
}