octoleo/syncthing
1
0
Fork 0
mirror of https://github.com/octoleo/syncthing.git synced 2025-01-03 07:12:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/syncthing: Enforce stricter CSRF policy on /rest GET requests

Browse Source 
GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/3137
This commit is contained in:
Jakob Borg 2016-05-21 13:48:55 +00:00
parent b4f941784f
commit 4a228697cd
2 changed files with 2 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/syncthing/gui.go
View File

@ -397,10 +397,6 @@ func corsMiddleware(next http.Handler) http.Handler {
// //
// See https://www.w3.org/TR/cors/ for details. // See https://www.w3.org/TR/cors/ for details.
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Add a generous access-control-allow-origin header since we may be
// redirecting REST requests over protocols
w.Header().Add("Access-Control-Allow-Origin", "*")
// Process OPTIONS requests // Process OPTIONS requests
if r.Method == "OPTIONS" { if r.Method == "OPTIONS" {
// Only GET/POST Methods are supported // Only GET/POST Methods are supported

15
cmd/syncthing/gui_csrf.go
View File

@ -40,7 +40,8 @@ func csrfMiddleware(unique string, prefix string, cfg config.GUIConfiguration, n
return return
} }
// Allow requests for the front page, and set a CSRF cookie if there isn't already a valid one. // Allow requests for anything not under the protected path prefix,
// and set a CSRF cookie if there isn't already a valid one.
if !strings.HasPrefix(r.URL.Path, prefix) { if !strings.HasPrefix(r.URL.Path, prefix) {
cookie, err := r.Cookie("CSRF-Token-" + unique) cookie, err := r.Cookie("CSRF-Token-" + unique)
if err != nil || !validCsrfToken(cookie.Value) { if err != nil || !validCsrfToken(cookie.Value) {
@ -55,18 +56,6 @@ func csrfMiddleware(unique string, prefix string, cfg config.GUIConfiguration, n
return return
} }
if r.Method == "GET" {
// Allow GET requests unconditionally, but if we got the CSRF
// token cookie do the verification anyway so we keep the
// csrfTokens list sorted by recent usage. We don't care about the
// outcome of the validity check.
if cookie, err := r.Cookie("CSRF-Token-" + unique); err == nil {
validCsrfToken(cookie.Value)
}
next.ServeHTTP(w, r)
return
}
// Verify the CSRF token // Verify the CSRF token
token := r.Header.Get("X-CSRF-Token-" + unique) token := r.Header.Get("X-CSRF-Token-" + unique)
if !validCsrfToken(token) { if !validCsrfToken(token) {