Mutlifix

internal/web/service.go

@@ -185,17 +185,21 @@ func (lrw *loggingResponseWriter) WriteHeader(code int) {
 	lrw.ResponseWriter.WriteHeader(code)
 }
 
-// render mints a CSRF token, fills ViewData defaults, and writes the response.
+// render fills ViewData defaults and writes the response.
+// If data.FormToken is empty (e.g. for call sites that don't use
+// basicViewData), a CSRF token is minted as a fallback.
 func (s *WebService) render(w http.ResponseWriter, r *http.Request, page string, data *ViewData) {
-	token, err := auth.SetCsrfCookie(w, r, CsrfCookieName)
-	if err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		return
-	}
 	if data == nil {
 		data = &ViewData{}
 	}
-	data.FormToken = token
+	if data.FormToken == "" {
+		token, err := auth.SetCsrfCookie(w, r, CsrfCookieName)
+		if err != nil {
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
+		data.FormToken = token
+	}
 	if data.Title == "" {
 		data.Title = page
 	}
@@ -228,7 +232,7 @@ func (s *WebService) currentUser(r *http.Request) (*user.User, error) {
 	return s.getUserInfo(r)
 }
 
-// basicViewData builds a ViewData with the current user and a CSRF token.
+// basicViewData builds a ViewData with the current user and CSRF token.
 func (s *WebService) basicViewData(w http.ResponseWriter, r *http.Request, title string) (*ViewData, bool) {
 	user, err := s.getUserInfo(r)
 	if err != nil {