esoko/rvr-nextgen
esoko/rvr-nextgen
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 5 Wiki Activity

RVRNEXT-2 disable anti csrf check in case of oauth token #8

Merged
bence merged 1 commits from feature/RVRNEXT-2-disable-anti-csrf-check-for-oauth-token into master 2023-04-08 20:03:21 +02:00
Conversation 0 Commits 1 Files Changed 2 +4 -1
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bc9f1a1d1f - Show all commits

2
public/index.php
View File

@ -35,7 +35,7 @@ if ($match !== null) {
return; return;
} }
if ($method === 'post' && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) { if ($method === 'post' && !in_array($url, $antiCsrfTokenExceptions) && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) {
$content = new SokoWeb\Response\JsonContent(['error' => 'no_valid_anti_csrf_token']); $content = new SokoWeb\Response\JsonContent(['error' => 'no_valid_anti_csrf_token']);
header('Content-Type: text/html; charset=UTF-8', true, 403); header('Content-Type: text/html; charset=UTF-8', true, 403);
$content->render(); $content->render();

3
web.php
View File

@ -78,3 +78,6 @@ Container::$request = new SokoWeb\Request\Request(
if (!Container::$request->session()->has('anti_csrf_token')) { if (!Container::$request->session()->has('anti_csrf_token')) {
Container::$request->session()->set('anti_csrf_token', bin2hex(random_bytes(16))); Container::$request->session()->set('anti_csrf_token', bin2hex(random_bytes(16)));
} }
//TODO: make a nicer logic
$antiCsrfTokenExceptions = ['oauth/token'];