From cfe1ed31bcd543bc63e013bdff4d294bc66d2fd4 Mon Sep 17 00:00:00 2001
From: xbdm <xbdm@xbdm.fun>
Date: Wed, 2 Aug 2023 14:07:33 -0400
Subject: [PATCH] Missing CSRF middleware
 https://github.com/Metastem/wikiless/security/code-scanning/1 [FIXED]

---
 src/wikiless.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/wikiless.js b/src/wikiless.js
index 8807ef5..62015a7 100644
--- a/src/wikiless.js
+++ b/src/wikiless.js
@@ -3,6 +3,8 @@ const compression = require('compression')
 const path = require('path')
 const express = require('express')
 const cookieParser = require('cookie-parser')
+const session = require("express-session")
+const csrf = require('lusca').csrf;
 const fs = require('fs')
 const app = express()
 const r = require('redis')
@@ -76,6 +78,8 @@ if(config.redirect_http_to_https) {
 app.use(compression())
 app.use(cookieParser())
 app.use(bodyParser.urlencoded({ extended: true, limit: '10mb' }))
+app.use(session({ secret: process.env['SECRET'], cookie: { maxAge: 60000 } }));
+app.use(csrf());
 app.use(express.static(path.join(__dirname, '../static')))
 app.use(express.static(path.join(__dirname, '../media')))