[PR #19] [MERGED] Add CSRF tokens to settings UI and move page to Settings menu #42

New issue

Closed

opened 2026-10-15 12:55:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:55:07 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/unraid-plugin/pull/19
Author: @JBailes
Created: 4/24/2026
Status: ✅ Merged
Merged: 4/24/2026
Merged by: @JBailes

Base: wolf-plugin-rewrite ← Head: settings-ui-csrf

📝 Commits (1)

ee6829b Add CSRF tokens to settings UI, move page to Settings menu, bump to 2026.04.24

📊 Changes

3 files changed (+19 additions, -4 deletions)

View changed files

📝 gow.plg (+5 -1)
📝 packages/settings-ui/root/usr/local/emhttp/plugins/gow/gow.page (+13 -2)
📝 scripts/vars.sh (+1 -1)

📄 Description

Stacks on top of #18. Addresses tester feedback on the wolf-plugin-rewrite branch.

Summary

Add Unraid webGui CSRF token (hidden input) to all five POST forms in gow.page: save_and_deploy, start, stop, update, reconfigure. Without it, Unraid silently drops the submissions on a hardened install.
Validate the token server-side in the POST handler; reject mismatches with an inline error instead of acting on the request.
Change Menu="Utilities" to Menu="Settings" so the plugin page appears under Settings, matching the launch="Settings/gow" already set in gow.plg.
Bump version to 2026.04.24 in gow.plg and scripts/vars.sh so the release workflow builds a fresh settings-ui.txz with matching hashes. Changelog entry added.

Test plan

Install the plugin on an Unraid 6.12+ system and confirm the page appears under Settings, not Tools.
Click Install, Start, Stop, Update Images, and Reconfigure; each should act on the request (no silent drops).
Tamper with the csrf_token value via DevTools and resubmit; the page should render the "Invalid CSRF token" error and take no action.
Verify the 2026.04.24 tag triggers a release with settings-ui.txz + matching sha256/md5 sidecars.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/unraid-plugin/pull/19 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 4/24/2026 **Status:** ✅ Merged **Merged:** 4/24/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `wolf-plugin-rewrite` ← **Head:** `settings-ui-csrf` --- ### 📝 Commits (1) - [`ee6829b`](https://github.com/games-on-whales/unraid-plugin/commit/ee6829be9f85cf249e50a8ee42e50fa57b85095b) Add CSRF tokens to settings UI, move page to Settings menu, bump to 2026.04.24 ### 📊 Changes **3 files changed** (+19 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `gow.plg` (+5 -1) 📝 `packages/settings-ui/root/usr/local/emhttp/plugins/gow/gow.page` (+13 -2) 📝 `scripts/vars.sh` (+1 -1) </details> ### 📄 Description Stacks on top of #18. Addresses tester feedback on the wolf-plugin-rewrite branch. ## Summary - Add Unraid webGui CSRF token (hidden input) to all five POST forms in gow.page: save_and_deploy, start, stop, update, reconfigure. Without it, Unraid silently drops the submissions on a hardened install. - Validate the token server-side in the POST handler; reject mismatches with an inline error instead of acting on the request. - Change Menu="Utilities" to Menu="Settings" so the plugin page appears under Settings, matching the launch="Settings/gow" already set in gow.plg. - Bump version to 2026.04.24 in gow.plg and scripts/vars.sh so the release workflow builds a fresh settings-ui.txz with matching hashes. Changelog entry added. ## Test plan - [ ] Install the plugin on an Unraid 6.12+ system and confirm the page appears under Settings, not Tools. - [ ] Click Install, Start, Stop, Update Images, and Reconfigure; each should act on the request (no silent drops). - [ ] Tamper with the csrf_token value via DevTools and resubmit; the page should render the "Invalid CSRF token" error and take no action. - [ ] Verify the 2026.04.24 tag triggers a release with settings-ui.txz + matching sha256/md5 sidecars. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:55:07 +00:00