From 8137a007a120d39b8455c18bba4e5cb3048b1911 Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Fri, 9 Jan 2026 12:34:45 -0500
Subject: [PATCH] feat: Add CSRF protection to user preferences API

- Add CSRF validation to user_preferences.php
- Protects POST and DELETE methods
- Completes CSRF protection for all API endpoints

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 api/user_preferences.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/api/user_preferences.php b/api/user_preferences.php
index 5c67ae3..791bba0 100644
--- a/api/user_preferences.php
+++ b/api/user_preferences.php
@@ -17,6 +17,17 @@ if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
     exit;
 }
 
+// CSRF Protection
+require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
+if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'DELETE') {
+    $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+    if (!CsrfMiddleware::validateToken($csrfToken)) {
+        http_response_code(403);
+        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+        exit;
+    }
+}
+
 $userId = $_SESSION['user']['user_id'];
 
 // Create database connection