From 5bcc28a492ba2b02a4668f902f83a5f7585a2729 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B8=8D=E8=83=9C=E8=88=9F?= <1650473152@qq.com>
Date: Tue, 2 Sep 2025 11:37:27 +0800
Subject: [PATCH] =?UTF-8?q?feat(api):=20=E6=96=B0=E5=A2=9E=20CSRF=20?=
 =?UTF-8?q?=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 applications/extensions/init_error_views.py         | 6 +++++-
 applications/extensions/init_template_directives.py | 6 ++++++
 applications/view/system/dict.py                    | 8 +++++++-
 requirements.txt                                    | 1 +
 templates/system/dict/add.html                      | 1 +
 5 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/applications/extensions/init_error_views.py b/applications/extensions/init_error_views.py
index e0a812b..1461c65 100644
--- a/applications/extensions/init_error_views.py
+++ b/applications/extensions/init_error_views.py
@@ -10,6 +10,10 @@ def init_error_views(app):
     def page_not_found(e):
         return render_template('errors/404.html'), 404
 
+    @app.errorhandler(405)
+    def page_not_found(e):
+        return render_template('errors/404.html'), 404
+
     @app.errorhandler(500)
     def internal_server_error(e):
         return render_template('errors/500.html'), 500
@@ -18,4 +22,4 @@ def init_error_views(app):
     def ratelimit_exceeded(e):
         return jsonify(
             success=False, msg="请求频率超限，请稍后再试。"
-        )
\ No newline at end of file
+        )
diff --git a/applications/extensions/init_template_directives.py b/applications/extensions/init_template_directives.py
index 86eda39..0af8926 100644
--- a/applications/extensions/init_template_directives.py
+++ b/applications/extensions/init_template_directives.py
@@ -1,5 +1,6 @@
 from flask import session, current_app
 from flask_login import current_user
+from flask_wtf.csrf import generate_csrf
 
 
 def init_template_directives(app):
@@ -9,3 +10,8 @@ def init_template_directives(app):
             return bool(power in session.get('permissions'))
         else:
             return True
+
+    @app.template_global()
+    def csrf_input():
+        return f'<input type="hidden" name="csrf_token" value="{generate_csrf()}">'
+
diff --git a/applications/view/system/dict.py b/applications/view/system/dict.py
index 5fff51b..112281b 100644
--- a/applications/view/system/dict.py
+++ b/applications/view/system/dict.py
@@ -1,4 +1,6 @@
 from flask import Blueprint, render_template, request, jsonify
+from flask_wtf.csrf import validate_csrf
+from wtforms.validators import ValidationError
 
 from applications.common import curd
 from applications.common.helper import ModelFilter
@@ -49,7 +51,10 @@ def dict_type_add():
 @authorize("system:dict:add", log=True)
 def dict_type_save():
     req_json = request.get_json(force=True)
-
+    try:
+        validate_csrf(req_json.get("csrf_token"))
+    except ValidationError:
+        return fail_api(msg='非法请求')
     data = {
         'type_name': str_escape(req_json.get("typeName")),
         'type_code': str_escape(req_json.get("typeCode")),
@@ -180,6 +185,7 @@ def dict_data_add():
 def dict_data_save():
     req_json = request.get_json(force=True)
 
+
     data_label = str_escape(req_json.get("dataLabel"))
     data_value = str_escape(req_json.get("dataValue"))
     enable = str_escape(req_json.get("enable"))
diff --git a/requirements.txt b/requirements.txt
index f3b4c8c..fa93c4b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,6 +8,7 @@ cryptography==41.0.2
 decorator==5.1.1
 Flask==2.3.2
 Flask-APScheduler==1.12.4
+Flask-Limiter==3.12
 Flask-Login==0.6.2
 Flask-Mail==0.9.1
 flask-marshmallow==0.15.0
diff --git a/templates/system/dict/add.html b/templates/system/dict/add.html
index 276cc02..6571ef3 100644
--- a/templates/system/dict/add.html
+++ b/templates/system/dict/add.html
@@ -9,6 +9,7 @@
     <div class="mainBox">
         <div class="main-container">
             <div class="main-container">
+                {{ csrf_input()|safe }}
                 <div class="layui-form-item">
                     <label class="layui-form-label">名称</label>
                     <div class="layui-input-block">