public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 15:05:56 +00:00
Code Issues Releases Wiki Activity

- backend: require CSRF token to be passed via POST

Browse Source 
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
This commit is contained in:
Andrew Dolgov
2020-09-15 16:12:53 +03:00
parent aeaafefa07
commit 8080c525fd
6 changed files with 45 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
js/App.js
View File

@@ -126,7 +126,33 @@ const App = {
return callOriginal(options);
}
);
},
},
postOpenWindow: function(target, params) {
const w = window.open("");
if (w) {
w.opener = null;
const form = document.createElement("form");
form.setAttribute("method", "post");
form.setAttribute("action", App.getInitParam("self_url_prefix") + "/" + target);
for (const [k,v] of Object.entries(params)) {
const field = document.createElement("input");
field.setAttribute("name", k);
field.setAttribute("value", v);
field.setAttribute("type", "hidden");
form.appendChild(field);
}
w.document.body.appendChild(form);
form.submit();
}
},
urlParam: function(param) {
return String(window.location.href).parseQuery()[param];
},
@@ -986,8 +1012,11 @@ const App = {
};
this.hotkey_actions["feed_debug_update"] = () => {
if (!Feeds.activeIsCat() && parseInt(Feeds.getActive()) > 0) {
window.open("backend.php?op=feeds&method=update_debugger&feed_id=" + Feeds.getActive() +
"&csrf_token=" + this.getInitParam("csrf_token"));
//window.open("backend.php?op=feeds&method=update_debugger&feed_id=" + Feeds.getActive());
/* global __csrf_token */
App.postOpenWindow("backend.php", {op: "feeds", method: "update_debugger", feed_id: Feeds.getActive(), csrf_token: __csrf_token});
} else {
alert("You can't debug this kind of feed.");
}