luckyimnotanigger/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-06-21 16:40:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Fix #5226 by adding CSRF checking to api reqToken and add CSRF to the POST header for deadline (#5250)

Browse source 
* Add CSRF checking to reqToken and place CSRF in the post for deadline creation

Fixes #5226, #5249

* /api/v1/admin/users routes should have reqToken middleware
This commit is contained in:
zeripath 2018-11-04 01:15:55 +00:00 • committed by techknowlogick
parent 57a8440db3
commit 7096085f2b
5 changed files with 32 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
routers/api/v1/api.go
View file

@ -174,11 +174,15 @@ func repoAssignment() macaron.Handler {
// Contexter middleware already checks token for user sign in process.
func reqToken() macaron.Handler {
return func(ctx *context.Context) {
if true != ctx.Data["IsApiToken"] {
ctx.Error(401)
return func(ctx *context.APIContext) {
if true == ctx.Data["IsApiToken"] {
return
}
if ctx.IsSigned {
ctx.RequireCSRF()
return
}
ctx.Context.Error(401)
}
}
@ -635,7 +639,7 @@ func RegisterRoutes(m *macaron.Macaron) {
m.Post("/repos", bind(api.CreateRepoOption{}), admin.CreateRepo)
})
})
}, reqAdmin())
}, reqToken(), reqAdmin())
m.Group("/topics", func() {
m.Get("/search", repo.TopicSearch)