From fc98c61f7bf18ac18f692a8b1654c16d9bd3bff5 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Fri, 7 May 2021 08:21:16 +0800
Subject: [PATCH] core: fix csrf

---
 packages/hydrooj/package.json          | 2 +-
 packages/hydrooj/src/service/server.ts | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index b7b142866..7a1b55de6 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.24.18",
+    "version": "2.24.19",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/service/server.ts b/packages/hydrooj/src/service/server.ts
index 7fa53fce9..b4ac2d89f 100644
--- a/packages/hydrooj/src/service/server.ts
+++ b/packages/hydrooj/src/service/server.ts
@@ -482,10 +482,6 @@ export class Handler extends HandlerCommon {
     }
 
     async init({ domainId }) {
-        if (this.request.headers.referer) {
-            const hostname = new URL(this.request.headers.referer).hostname;
-            if (hostname !== this.request.hostname) throw new CsrfTokenError();
-        }
         if (!argv.benchmark) await this.limitRate('global', 10, 88);
         const [absoluteDomain, inferDomain, bdoc] = await Promise.all([
             domain.get(domainId),
@@ -524,6 +520,10 @@ export class Handler extends HandlerCommon {
                 text: global.Hydro.lib[key].text,
             }));
         if (!this.noCheckPermView) this.checkPerm(PERM.PERM_VIEW);
+        if (this.request.method === 'POST' && this.request.headers.referer) {
+            const hostname = new URL(this.request.headers.referer).hostname;
+            if (hostname !== this.request.hostname) throw new CsrfTokenError(hostname);
+        }
     }
 
     async finish() {