esoko/rvr-nextgen
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases 5 Wiki Activity

RVRNEXT-2 disable anti csrf check in case of oauth token
rvr-nextgen/pipeline/pr-master This commit looks good
Details

Browse Source
This commit is contained in:
bence committed 2023-04-08 20:02:02 +02:00
1 parent 84df948012
commit bc9f1a1d1f
2 files changed
+4 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

public/index.php
+1 -1
View File
@@ -35,7 +35,7 @@ if ($match !== null) {
return;
}
if ($method === 'post' && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) {
if ($method === 'post' && !in_array($url, $antiCsrfTokenExceptions) && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) {
$content = new SokoWeb\Response\JsonContent(['error' => 'no_valid_anti_csrf_token']);
header('Content-Type: text/html; charset=UTF-8', true, 403);
$content->render();