Security hardening

templates/page1_email.html

@@ -12,6 +12,7 @@
 </div>
 
 <form method="POST" action="{{ url_for('submit_email') }}" class="application-form">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     <input type="hidden" name="job_name" value="{{ job_name }}">
 
     <div class="form-group">

templates/page2_personal.html

@@ -11,6 +11,7 @@
 </div>
 
 <form method="POST" action="{{ url_for('submit_personal', session_id=session_id) }}" class="application-form">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
 
     <div class="form-section">
         <h3>Persönliche Informationen</h3>

templates/page3_motivation.html

@@ -12,6 +12,7 @@
 </div>
 
 <form method="POST" action="{{ url_for('submit_motivation', session_id=session_id) }}" class="application-form">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
 
     <div class="form-group">
         <label for="current_job">Bitte beschreiben Sie Ihre aktuelle berufliche Situation.</label>

templates/page4_upload.html

@@ -24,6 +24,7 @@
             <span class="file-name">{{ file.original_name }}</span>
             <span class="file-size">({{ "%.2f"|format(file.size / 1024 / 1024) }} MB)</span>
             <form method="POST" action="{{ url_for('remove_file', session_id=session_id, file_index=loop.index0) }}" style="display: inline;">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <button type="submit" class="btn btn-danger btn-small">Entfernen</button>
             </form>
         </li>
@@ -36,6 +37,7 @@
 <div class="upload-section">
     <h3>Dokument hochladen</h3>
     <form method="POST" action="{{ url_for('upload_file', session_id=session_id) }}" enctype="multipart/form-data" class="upload-form">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
         <div class="form-group">
             <label for="file">Datei auswählen</label>
             <input
@@ -64,6 +66,7 @@
     </p>
 
     <form method="POST" action="{{ url_for('submit_application', session_id=session_id) }}">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
         <div class="form-actions">
             <button type="submit" class="btn btn-primary btn-large">Bewerbung absenden</button>
         </div>