From 291708692b482f17a94acdc294f00d2d0084d90c Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Wed, 16 Feb 2022 23:10:43 +0300
Subject: [PATCH] add ajax action to get csrf token (for external
 authentication)

---
 src/ajax.php | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/ajax.php b/src/ajax.php
index d5a0e2f..bd8f151 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -309,7 +309,7 @@ elseif(isset($_POST['login']))
     }
     if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
         updateSessionLogged(true);
-        update_token();
+        $t['token'] = update_token();
         $t['logged'] = 1;
     }
     jsonExit($t);
@@ -541,6 +541,23 @@ elseif(isset($_GET['setHideList']))
     }
     jsonExit(array('total'=>1));
 }
+elseif (isset($_POST['createSession']))
+{
+    $t = array();
+    if (!need_auth()) {
+        $t['disabled'] = 1;
+        jsonExit($t);
+    }
+    if (access_token() == '') {
+        update_token();
+    }
+    $t['token'] = access_token();
+    $t['session'] = session_id();
+    jsonExit($t);
+}
+else {
+    jsonExit(['total' => 0]);
+}
 
 
 ###################################################################################################