diff options
| author | Lukas Fleischer <archlinux@cryptocrack.de> | 2013-08-27 02:18:59 +0200 |
|---|---|---|
| committer | Lukas Fleischer <archlinux@cryptocrack.de> | 2013-08-27 02:27:19 +0200 |
| commit | 69b98efa35d48d794394df938741fdfc342cfb84 (patch) | |
| tree | 34a032d8d80c9fabb666f775e3d7549dc58584bb /web/html | |
| parent | 3bc951e3d87eaf692a7e47cf16a28d838c7cb2bd (diff) | |
| download | aurweb-69b98efa35d48d794394df938741fdfc342cfb84.tar.xz | |
Re-add CRSF tokens to most package actions
We fixed all known CRSF vulnerabilities in commit 2c93f0a (Implement
token system to fix CSRF vulnerabilities, 2012-06-23). c349cb2 (Add
virtual path support for package actions, 2012-07-17) partly reverted
this by injecting a valid CRSF token when virtual paths are in use.
This patch allows for keeping the virtual path feature, while
reintroducing POST forms and CRSF tokens. Actions like package flagging,
votes and notifications are no longer prone to CRSF (see FS#35437 for
details).
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/html')
| -rw-r--r-- | web/html/index.php | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/web/html/index.php b/web/html/index.php index 1cb48ac..be6c98d 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -59,10 +59,6 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { return; } - if (isset($_COOKIE['AURSID'])) { - $_POST['token'] = $_COOKIE['AURSID']; - } - $_POST['IDs'] = array(pkgid_from_name($tokens[2]) => '1'); } } |