v0.126.3: storage wizard CSRF on claimed boxes — wizard pages rendered via raw render() shipped an EMPTY csrf-meta token, every /api/storage/init|attach POST died with 'token mismatch'; latent until the claim arc (unclaimed boxes skip CsrfProtect); fix = executeTemplate injection + session-backed regression test (red-proven)

2026-07-13 13:51:19 +02:00
parent 93c95f0fb5
commit f8df1e9f16
3 changed files with 58 additions and 1 deletions
@@ -261,7 +261,11 @@ func (s *Server) storageWizardPageHandler(w http.ResponseWriter, r *http.Request
 		title = "Meglévő meghajtó csatolása"
 	}
 	data := s.baseData(tmpl, title)
-	s.render(w, tmpl, data)
+	// executeTemplate, NOT render(): the wizard POSTs /api/storage/* with the csrf-meta token,
+	// and render() leaves {{.CSRFToken}} empty. Latent until the claim arc — on an unclaimed
+	// (auth-off) box CsrfProtect is skipped entirely, so the wizard had never run against a
+	// CLAIMED box before; first hit = the agent-0.87.0 drill wizard leg ("token mismatch").
+	s.executeTemplate(w, r, tmpl, data)
 }

 // ServeStorageAPI dispatches /api/storage/* (guided init/attach/eject orchestration).