MetaZone/mce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 统一 CSRF token 获取方式，修复 token 刷新后缓存失效

Browse Source 
- utils.js getCSRFToken() 改为从 cookie 优先读取，meta 标签作为后备
- show.html 5处移除 csrfToken 缓存变量，改用 getCSRFToken() 动态获取
- studio/posts.html/drafts.html 移除 {{ .CSRFToken }} 模板硬编码
- studio-editor.js 移除本地 getCsrfToken()，改用共享 getCSRFToken()
- settings/index.html messages/index.html 改用 getCSRFToken()
- admin posts.js/comments.js 移除本地/死代码 CSRF 获取，统一用共享方法
This commit is contained in:
Victor Jay
2026-06-02 18:47:22 +08:00
parent a83e0840d7
commit abe1388f8c
9 changed files with 24 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
templates/MetaLab-2026/html/posts/show.html
View File

@ -187,12 +187,11 @@
if (!btn) return;
btn.addEventListener('click', function() {
if (!confirm('确认提交审核？审核通过后将公开发布。')) return;
var csrf = document.querySelector('meta[name="csrf-token"]');
fetch('/api/posts/' + btn.dataset.id + '/submit', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-CSRF-Token': csrf ? csrf.getAttribute('content') : ''
'X-CSRF-Token': getCSRFToken()
}
})
.then(function(r) { return r.json(); })
@ -217,8 +216,6 @@
if (!btn || !overlay) return;
var postId = btn.dataset.id;
var csrfMeta = document.querySelector('meta[name="csrf-token"]');
var csrfToken = csrfMeta ? csrfMeta.getAttribute('content') : '';
function showOverlay() {
overlay.style.display = 'flex';
@ -256,7 +253,7 @@
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-CSRF-Token': csrfToken
'X-CSRF-Token': getCSRFToken()
},
body: JSON.stringify({ post_id: parseInt(postId), amount: amount })
})
@ -297,8 +294,6 @@
if (!container || !likeBtn || !dislikeBtn) return;
var postId = container.dataset.postId;
var csrfMeta = document.querySelector('meta[name="csrf-token"]');
var csrfToken = csrfMeta ? csrfMeta.getAttribute('content') : '';
// 页面加载时获取当前反应状态
fetch('/api/posts/' + postId + '/reaction')
@ -321,7 +316,7 @@
likeBtn.disabled = true;
fetch('/api/posts/' + postId + '/like', {
method: 'POST',
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken }
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': getCSRFToken() }
})
.then(function(r) {
if (r.status === 401) { window.location.href = '/auth/login?redirect=/posts/' + postId; return null; }
@ -343,7 +338,7 @@
dislikeBtn.disabled = true;
fetch('/api/posts/' + postId + '/dislike', {
method: 'POST',
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken }
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': getCSRFToken() }
})
.then(function(r) {
if (r.status === 401) { window.location.href = '/auth/login?redirect=/posts/' + postId; return null; }
@ -377,15 +372,14 @@
if (!favBtn || !container) return;
var postId = container.dataset.postId;
var csrfMeta = document.querySelector('meta[name="csrf-token"]');
var csrfToken = csrfMeta ? csrfMeta.getAttribute('content') : '';
var isFavorited = false;
var currentFolderId = null;
var loading = false;
function api(method, url, data) {
var opts = { method: method, headers: { 'Content-Type': 'application/json' } };
if (csrfToken) opts.headers['X-CSRF-Token'] = csrfToken;
var token = getCSRFToken();
if (token) opts.headers['X-CSRF-Token'] = token;
if (data) opts.body = JSON.stringify(data);
return fetch(url, opts).then(function(r) {
if (r.status === 401) { window.location.href = '/auth/login?redirect=/posts/' + postId; throw new Error('unauthorized'); }
@ -469,7 +463,7 @@
// 无弹窗回退（未登录跳转）
function handleNoModal() {
if (!csrfToken) {
if (!getCSRFToken()) {
window.location.href = '/auth/login?redirect=/posts/' + postId;
return;
}
@ -571,7 +565,7 @@
// 事件：点击收藏按钮 → 打开弹窗
favBtn.addEventListener('click', function() {
if (!csrfToken) { window.location.href = '/auth/login?redirect=/posts/' + postId; return; }
if (!getCSRFToken()) { window.location.href = '/auth/login?redirect=/posts/' + postId; return; }
showModal();
});
@ -627,15 +621,14 @@
var commentInput = document.getElementById('commentInput');
var commentSubmitBtn = document.getElementById('commentSubmitBtn');
var mentionDropdown = document.getElementById('mentionDropdown');
var csrfMeta = document.querySelector('meta[name="csrf-token"]');
var csrfToken = csrfMeta ? csrfMeta.getAttribute('content') : '';
var currentPage = 1;
var totalPages = 1;
// ====== 工具函数 ======
function api(method, url, data) {
var opts = { method: method, headers: { 'Content-Type': 'application/json' } };
if (csrfToken) opts.headers['X-CSRF-Token'] = csrfToken;
var token = getCSRFToken();
if (token) opts.headers['X-CSRF-Token'] = token;
if (data) opts.body = JSON.stringify(data);
return fetch(url, opts).then(function(r) { return r.json(); });
}
@ -1031,7 +1024,7 @@
fetch('/api/comments/upload-image', {
method: 'POST',
headers: { 'X-CSRF-Token': csrfToken },
headers: { 'X-CSRF-Token': getCSRFToken() },
body: formData
})
.then(function(r) { return r.json(); })