From 2d6436dca65265ab5589a40072c23e8190f2ecd7 Mon Sep 17 00:00:00 2001 From: Harry Culpan Date: Tue, 30 Jun 2026 18:23:27 -0400 Subject: [PATCH] Add missing auth check to saveSetupHandler Consistent with all other mutation handlers which already guard with ValidateJWTFromCookie. Co-Authored-By: Claude Sonnet 4.6 --- cmd/web/savesetuphandler.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cmd/web/savesetuphandler.go b/cmd/web/savesetuphandler.go index 21638eb..0b8ba66 100644 --- a/cmd/web/savesetuphandler.go +++ b/cmd/web/savesetuphandler.go @@ -13,6 +13,11 @@ import ( ) func saveSetupHandler(w http.ResponseWriter, r *http.Request) { + if !ValidateJWTFromCookie(r, appKey) { + http.Error(w, "Unauthorized", http.StatusUnauthorized) + return + } + r.ParseForm() nextSession := r.FormValue("nextSession") incDays := r.FormValue("incDays")