ui: remove outdated csrfToken field

packages/fps-importer/template/problem_import_fps.html

@@ -12,7 +12,6 @@
             </label>
           </div></div>
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <button type="submit" class="rounded primary button">
               {{ _('Import') }}
             </button>
@@ -22,13 +21,12 @@
           </div></div>
         </form>
         <form method="post" enctype="multipart/form-data" action="{{ url('file_upload') }}">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
-            <p>{{ _('Upload file') }}:
-              <input type="hidden" name="title" value="FPS_IMPORT">
-              <input type="hidden" name="redirect" value="{{ url('problem_import_fps') }}">
-              <input type="file" name="file">
-              <input type="submit" value="{{ _('Upload') }}" class="rounded primary button">
-            </p>
+          <p>{{ _('Upload file') }}:
+            <input type="hidden" name="title" value="FPS_IMPORT">
+            <input type="hidden" name="redirect" value="{{ url('problem_import_fps') }}">
+            <input type="file" name="file">
+            <input type="submit" value="{{ _('Upload') }}" class="rounded primary button">
+          </p>
         </form>
       </div>
     </div>

packages/hydrooj/src/handler/domain.ts

@@ -193,7 +193,6 @@ class DomainPermissionHandler extends ManageHandler {
     @requireSudo
     async post({ domainId }) {
         const roles = {};
-        delete this.request.body.csrfToken;
         for (const role in this.request.body) {
             const perms = this.request.body[role] instanceof Array
                 ? this.request.body[role]

packages/ui-default/templates/blog_detail.html

@@ -32,7 +32,6 @@
       {% if handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
         <li><form class="form--inline" method="post">
           <input type="hidden" name="operation" value="{% if not dsdoc['star'] %}star{% else %}unstar{% endif %}">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <button class="star{% if dsdoc['star'] %} activated{% endif %}" type="submit">
             <span class="starred--hide"><span class="icon icon-star--outline"></span> {{ _('Star') }}</span>
             <span class="starred--show"><span class="icon icon-star"></span> {{ _('Unstar') }}</span>

packages/ui-default/templates/components/comments_discussion.html

@@ -58,7 +58,6 @@
             <input type="button" class="rounded button nojs--hide" name="dczcomments__box__cancel" value="{{ _('Cancel') }} (Esc)">
           </div>
           <input type="hidden" name="operation" value="{{ comment_post_op }}">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
         </form>
       </div>
       <div class="nojs--hide">

packages/ui-default/templates/components/comments_solution.html

@@ -54,7 +54,6 @@
             <input type="button" class="rounded button nojs--hide" name="dczcomments__box__cancel" value="{{ _('Cancel') }} (Esc)">
           </div>
           <input type="hidden" name="operation" value="{{ comment_post_op }}">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
         </form>
       </div>
       <div class="nojs--hide">
@@ -89,16 +88,9 @@
         <div class="vote-number rotator--enabled">{{ doc.vote }}</div>
         <div class="vote-op clearfix">
           <form method="post">
-            <input type="hidden" name="operation" value="upvote">
             <input type="hidden" name="psid" value="{{ doc._id }}">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
-            <button type="submit" class="vote-button upvote{% if pssdict[doc._id].vote == 1 %} active{% endif %}" data-tooltip="{{ _('Upvote') }}" data-tooltip-pos="bottom center" aria-label="{{ _('Upvote') }}"><span class="icon icon-vote--up"></span></button>
-          </form>
-          <form method="post">
-            <input type="hidden" name="operation" value="downvote">
-            <input type="hidden" name="psid" value="{{ doc._id }}">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
-            <button type="submit" class="vote-button downvote{% if pssdict[doc._id].vote == -1 %} active{% endif %}" data-tooltip="{{ _('Downvote') }}" data-tooltip-pos="bottom center" aria-label="{{ _('Downvote') }}"><span class="icon icon-vote--down"></span></button>
+            <button type="submit" name="operation" value="upvote" class="vote-button upvote{% if pssdict[doc._id].vote == 1 %} active{% endif %}" data-tooltip="{{ _('Upvote') }}" data-tooltip-pos="bottom center" aria-label="{{ _('Upvote') }}"><span class="icon icon-vote--up"></span></button>
+            <button type="submit" name="operation" value="downvote" class="vote-button downvote{% if pssdict[doc._id].vote == -1 %} active{% endif %}" data-tooltip="{{ _('Downvote') }}" data-tooltip-pos="bottom center" aria-label="{{ _('Downvote') }}"><span class="icon icon-vote--down"></span></button>
           </form>
         </div>
       {% else %}

packages/ui-default/templates/contest_edit.html

@@ -185,7 +185,6 @@
           </div>
           <div class="row">
             <div class="columns">
-              <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
               {% if page_name == 'contest_edit' %}
                 <button name="operation" value="update" type="submit" class="rounded primary button">
                   {{ _('Update') }}

packages/ui-default/templates/discussion_create.html

@@ -10,7 +10,6 @@
         <form method="post">
           {% include "partials/discussion_edit_form.html" %}
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <button type="submit" class="rounded primary button">
               {{ _('Create') }} (Ctrl+Enter)
             </button>

packages/ui-default/templates/discussion_detail.html

@@ -42,7 +42,6 @@
       {% if handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
         <li><form class="form--inline" method="post">
           <input type="hidden" name="operation" value="{% if not dsdoc['star'] %}star{% else %}unstar{% endif %}">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <button class="star{% if dsdoc['star'] %} activated{% endif %}" type="submit">
             <span class="starred--hide"><span class="icon icon-star--outline"></span> {{ _('Star Topic') }}</span>
             <span class="starred--show"><span class="icon icon-star"></span> {{ _('Unstar Topic') }}</span>

packages/ui-default/templates/discussion_edit.html

@@ -7,7 +7,6 @@
         <form method="post">
           {% include "partials/discussion_edit_form.html" %}
             <div class="row"><div class="columns">
-              <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
               <button name="operation" value="update" data-default-submit type="submit" class="rounded primary button">
                 {{ _('Update') }} (Ctrl+Enter)
               </button>

packages/ui-default/templates/domain_create.html

@@ -40,7 +40,6 @@
                 name:'avatar'
             }) }}
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <button type="submit" class="rounded primary button">
               {{ _('Create') }}
             </button>

packages/ui-default/templates/domain_join.html

@@ -13,7 +13,6 @@
       </div>
       <div class="section__body typo">
         <form method="post">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
         {% if joinSettings['method'] == model.domain.JOIN_METHOD_CODE %}
           {{ form.form_text({
                columns:None,

packages/ui-default/templates/domain_join_applications.html

@@ -60,7 +60,6 @@
         help_text:'The invitation code to enter to successfully join the domain. You can only use letters and numbers in the code and it should not be longer than 64 characters.',
         value:joinSettings['code']|default('')
       }) }}
-      <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
       <button class="rounded primary button" role="submit">
         {{ _('Update Settings') }}
       </button>

packages/ui-default/templates/domain_permission.html

@@ -62,7 +62,6 @@
     </table>
   </div>
   <div class="section__body">
-    <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
     <button class="rounded primary button" role="submit">
       {{ _('Update Permission') }}
     </button>

packages/ui-default/templates/home_security.html

@@ -41,7 +41,6 @@
                required:true
              }) }}
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <input type="hidden" name="operation" value="change_mail">
             <input type="submit" class="rounded primary button" value="{{ _('Change Email') }}">
           </div></div>
@@ -78,7 +77,6 @@
                required:true
              }) }}
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <input type="hidden" name="operation" value="change_password">
             <input type="submit" class="rounded primary button" value="{{ _('Change Password') }}">
           </div></div>
@@ -135,7 +133,6 @@
                 <form method="post">
                   <input type="hidden" name="operation" value="delete_token">
                   <input type="hidden" name="tokenDigest" value="{{ session._id }}">
-                  <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
                   <input type="submit" value="{{ _('Logout This Session') }}" class="rounded button">
                 </form>
               </div>
@@ -148,7 +145,6 @@
       <div class="section__body">
         <form method="post">
           <input type="hidden" name="operation" value="delete_all_tokens">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <input type="submit" value="{{ _('Logout All Sessions') }}" class="primary rounded button">
         </form>
         {% if geoipProvider %}

packages/ui-default/templates/homework_edit.html

@@ -90,7 +90,6 @@
               markdown:true
           }) }}
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           {% if page_name == 'homework_edit' %}
             <button type="submit" class="rounded primary button">
               {{ _('Update') }}

packages/ui-default/templates/partials/contest_sidebar.html

@@ -43,7 +43,6 @@
     {% if handler.user.hasPerm(perm.PERM_ATTEND_CONTEST) and handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
       <form action="{{ url('contest_detail', tid=tdoc.docId) }}" method="POST">
         <input type="hidden" name="operation" value="attend">
-        <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
         <button class="menu__link" {% if tdoc._code %}data-contest-code{% endif %} type="submit">
           <span class="icon icon-add"></span> {{ _('Attend Contest') }}
         </button>

packages/ui-default/templates/partials/homework_sidebar.html

@@ -27,7 +27,6 @@
     {% if handler.user.hasPerm(perm.PERM_ATTEND_HOMEWORK) and handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
         <form action="{{ url('homework_detail', tid=tdoc.docId) }}" method="POST">
           <input type="hidden" name="operation" value="attend">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <button class="menu__link" type="submit">
             <span class="icon icon-add"></span> {{ _('Claim Homework') }}
           </button>

packages/ui-default/templates/partials/login_dialog.html

@@ -38,7 +38,6 @@
             <input type="checkbox" name="rememberme" class="checkbox">{{ _('Remember me') }}
           </label>
         </div></div>
-        <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
         <div class="row"><div class="columns">
           <input type="submit" value="{{ _('Sign In') }}" class="expanded rounded primary button">
         </div></div>

packages/ui-default/templates/partials/problem_sidebar_normal.html

@@ -55,7 +55,6 @@
       <li class="menu__item">
         <form method="post" action="{{ url('problem_detail', pid=pdoc.docId) }}">
           <input type="hidden" name="operation" value="rejudge">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <button type="submit" class="menu__link" name="problem-sidebar__rejudge">
             <span class="icon icon-refresh"></span> {{ _('Rejudge all submissions') }}
           </button>

packages/ui-default/templates/partials/setting.html

@@ -87,7 +87,6 @@
   </div>
 {%- endif -%}{%- endfor -%}
   <div class="section__body">
-    <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
     <input type="submit" class="rounded primary button" value="{{ _('Save All Changes') }}">
   </div>
 </form>

packages/ui-default/templates/partials/training_detail.html

@@ -123,7 +123,6 @@
                         <form class="form--inline" action="{{ url('problem_main') }}" method="post">
                           <input type="hidden" name="pid" value="{{ pdoc.docId }}">
                           <input type="hidden" name="operation" value="{% if not psdoc['star'] %}star{% else %}unstar{% endif %}">
-                          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
                           <button class="star{% if psdoc['star'] %} activated{% endif %}" type="submit">
                             <span class="starred--hide"><span class="icon icon-star--outline" data-tooltip="{{ _('Star') }}"></span></span>
                             <span class="starred--show"><span class="icon icon-star" data-tooltip="{{ _('Unstar') }}"></span></span>

packages/ui-default/templates/problem_edit.html

@@ -63,7 +63,6 @@
           <div><textarea data-editor{% if page_name == 'problem_edit' %} autofocus{% endif %} class="textbox auto-resize nojs--hide"></textarea></div>
           <textarea name="content" class="textbox hasjs--hide" data-markdown-upload style="height: 500px">{% if pdoc %}{{ pdoc['content']|toString }}{% else %}{% include 'partials/problem_default.md' %}{% endif %}</textarea>
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           {% if page_name == 'problem_edit' %}
             <button type="submit" class="rounded primary button">
               {{ _('Update') }}

packages/ui-default/templates/problem_hack.html

@@ -17,7 +17,6 @@
             </div>
           </div>
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <input type="submit" class="rounded primary button" value="{{ _('Submit') }}">
           </div></div>
         </form>

packages/ui-default/templates/problem_import.html

@@ -5,7 +5,6 @@
     <div class="section">
       <div class="section__body">
         <form method="post" enctype="multipart/form-data">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <p>{{ _('Upload zipfile') }} {% if type %}({{ _('Type') }}: {{type}}){% endif %}:
             <input type="file" name="file">
             {% if handler.user.hasPriv(PRIV.PRIV_EDIT_SYSTEM) and not type %}<input type="checkbox" name="keepUser">{% endif %}

packages/ui-default/templates/problem_submit.html

@@ -26,7 +26,6 @@
             </div>
           </div>
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <input type="submit" class="rounded primary button" value="{{ _('Submit') }}">
           </div></div>
         </form>

packages/ui-default/templates/record_detail.html

@@ -33,18 +33,14 @@
         <ol class="menu">
           <li class="menu__item">
             <form method="post">
-              <input type="hidden" name="operation" value="rejudge">
-              <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
-              <button type="submit" class="menu__link">
+              <button type="submit" name="operation" value="rejudge" class="menu__link">
                 <span class="icon icon-refresh"></span> {{ _('Rejudge') }}
               </button>
             </form>
           </li>
           <li class="menu__item">
             <form method="post">
-              <input type="hidden" name="operation" value="cancel">
-              <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
-              <button type="submit" class="menu__link">
+              <button type="submit" name="operation" value="cancel" class="menu__link">
                 <span class="icon icon-close"></span> {{ _('Cancel Score') }}
               </button>
             </form>

packages/ui-default/templates/training_detail.html

@@ -64,7 +64,6 @@
           <li class="menu__item">
             <form action="" method="POST">
               <input type="hidden" name="operation" value="enroll">
-              <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
               <button class="menu__link" type="submit">
                 <span class="icon icon-add"></span> {{ _('Enroll Training') }}
               </button>

packages/ui-default/templates/training_edit.html

@@ -41,7 +41,6 @@
             </label>
           </div></div>
           <div class="row"><div class="columns">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           {% if page_name == 'training_edit' %}
             <button type="submit" class="rounded primary button">
               {{ _('Update') }}

packages/ui-default/templates/training_files.html

@@ -28,7 +28,6 @@
           <li class="menu__item">
             <form action="" method="POST">
               <input type="hidden" name="operation" value="enroll">
-              <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
               <button class="menu__link" type="submit">
                 <span class="icon icon-add"></span> {{ _('Enroll Training') }}
               </button>

packages/ui-default/templates/user_login.html

@@ -30,7 +30,6 @@
       </div></div>
       <div class="row"><div class="columns">
         <div class="text-center">
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <input type="submit" value="{{ _('Login') }}" class="inverse expanded rounded primary button">
         </div>
       </div></div>

packages/ui-default/templates/user_logout.html

@@ -4,7 +4,6 @@
   <div class="immersive--content immersive--center">
     <h1>{{ _('Logout') }}</h1>
     <form method="POST">
-      <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
       <div class="text-center">
         <input type="submit" value="{{ _('Logout') }}" class="inverse rounded primary button">
       </div>

packages/ui-default/templates/user_lostpass.html

@@ -17,7 +17,6 @@
         </div></div>
         <div class="row"><div class="columns">
           <div class="text-center">
-            <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
             <input type="submit" value="{{ _('Send Password Reset Email') }}" class="inverse rounded primary button">
           </div>
         </div></div>

packages/ui-default/templates/user_lostpass_with_code.html

@@ -22,7 +22,6 @@
       </label>
     </div>
     <div class="text-center">
-      <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
       <input type="submit" value="{{ _('Reset Password') }}" class="inverse rounded primary button">
     </div>
   </form>

packages/ui-default/templates/user_register.html

@@ -13,7 +13,6 @@
       <div class="row"><div class="columns">
         <div class="text-center">
           {{ captcha|safe }}
-          <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
           <input id="submit" type="submit" value="{{ _('Send Verification Email') }}" class="inverse expanded rounded primary button">
         </div>
       </div></div>

packages/ui-default/templates/user_register_with_code.html

@@ -28,7 +28,6 @@
       </label>
     </div>
     <div class="text-center">
-      <input type="hidden" name="csrfToken" value="{{ handler.csrfToken }}">
       <input type="submit" value="{{ _('user_register') }}" class="inverse expanded rounded primary button">
     </div>
   </form>