feat(api): 新增 CSRF 校验

applications/extensions/init_error_views.py

@@ -10,6 +10,10 @@ def init_error_views(app):
     def page_not_found(e):
         return render_template('errors/404.html'), 404
 
+    @app.errorhandler(405)
+    def page_not_found(e):
+        return render_template('errors/404.html'), 404
+
     @app.errorhandler(500)
     def internal_server_error(e):
         return render_template('errors/500.html'), 500
@@ -18,4 +22,4 @@ def init_error_views(app):
     def ratelimit_exceeded(e):
         return jsonify(
             success=False, msg="请求频率超限，请稍后再试。"
-        )
+        )

applications/extensions/init_template_directives.py

@@ -1,5 +1,6 @@
 from flask import session, current_app
 from flask_login import current_user
+from flask_wtf.csrf import generate_csrf
 
 
 def init_template_directives(app):
@@ -9,3 +10,8 @@ def init_template_directives(app):
             return bool(power in session.get('permissions'))
         else:
             return True
+
+    @app.template_global()
+    def csrf_input():
+        return f'<input type="hidden" name="csrf_token" value="{generate_csrf()}">'
+