Adding csrf checking to every post handler.

1 files changed, 2 insertions, 0 deletions

diff --git a/routes/create.py b/routes/create.py
index 36c2521..c218d1f 100644
--- a/routes/create.py
+++ b/routes/create.py
@@ -41,6 +41,7 @@ def create():
 
 @app.route("/set/quiz",methods=["POST"])
 def new_quiz():
+    csrf_check("/#create")
     if not "id" in session.keys():
         session["alert"]="Tarvitset nimimerkin loudaksesi."
         return redirect("/#create")
@@ -51,6 +52,7 @@ def new_quiz():
 
 @app.route("/set/quiz_ready",methods=["POST"])
 def quiz_ready():
+    csrf_check("/#create")
     if "quiz_id" not in session.keys():
         session["alert"] = "Kyselmä jota ei ole aloitettu ei voi olla valmis."
         return redirect("/#create")