Merge pull request #448 from curveball/fix-create-group-form

Fix create group form

changelog.md

@@ -15,6 +15,7 @@ Changelog
 * Centralize CSRF token handling (for old browsers).
 * Added a new 'add privilege' action, which is helpful for API clients.
 * Fix bug: Incorrect url in `Location` header when creating a new user.
+* #448: Fix 'create group' form.
 
 
 0.22.0 (2022-09-27)

src/group/controller/new.ts

@@ -18,7 +18,11 @@ class CreateGroupController extends Controller {
       throw new Forbidden('Only users with the "admin" privilege can create new users');
     }
     ctx.response.type = 'text/html';
-    ctx.response.body = createGroupForm(ctx.query.msg, ctx.query.error);
+    ctx.response.body = createGroupForm({
+      csrfToken: await ctx.getCsrf(),
+      msg: ctx.query.msg,
+      error: ctx.query.error
+    });
   }
 
   async post(ctx: Context) {

src/group/formats/html.ts

@@ -1,11 +1,22 @@
 import { render } from '../../templates';
 
-export function createGroupForm(msg: string, error: string) {
+type Options = {
+  csrfToken: string;
+  msg: string|undefined;
+  error: string|undefined;
+}
+
+export function createGroupForm(options: Options) {
+
+  const hiddenFields: Record<string, string> = {
+    'csrf-token': options.csrfToken,
+  };
 
   return render('create-group', {
     title: 'Create Group',
-    msg: msg,
-    error,
-    action: '/group/new'
+    msg: options.msg,
+    error: options.error,
+    action: '/group/new',
+    hiddenFields,
   });
 }