lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix csrf on referrer is duplicate with csrf on token. We keep token only

Browse Source
This commit is contained in:
Laurent Destailleur 2023-02-06 21:23:02 +01:00
parent ec9e8d3c3b
commit 5bddb31b90
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/conf/conf.php.example
View File

@ -302,7 +302,7 @@ $dolibarr_main_restrict_ip='';
// This might be required if you access Dolibarr behind a proxy that make bad URL rewriting, to avoid false alarms. // This might be required if you access Dolibarr behind a proxy that make bad URL rewriting, to avoid false alarms.
// In most cases, you should always keep this to 0. // In most cases, you should always keep this to 0.
// Default value: 0 // Default value: 0
// Possible values: 0 or 1 // Possible values: 0 or 1 (no strict CSRF test, only test on referer) or 2 (no CSRF test at all)
// Examples: // Examples:
// $dolibarr_nocsrfcheck='0'; // $dolibarr_nocsrfcheck='0';
// //

2
htdocs/filefunc.inc.php
View File

@ -206,7 +206,7 @@ include_once DOL_DOCUMENT_ROOT.'/core/lib/security.lib.php';
// when we post forms (we allow GET and HEAD to accept direct link from a particular page). // when we post forms (we allow GET and HEAD to accept direct link from a particular page).
// Note about $_SERVER[HTTP_HOST/SERVER_NAME]: http://shiflett.org/blog/2006/mar/server-name-versus-http-host // Note about $_SERVER[HTTP_HOST/SERVER_NAME]: http://shiflett.org/blog/2006/mar/server-name-versus-http-host
// See also CSRF protections done into main.inc.php // See also CSRF protections done into main.inc.php
if (!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck)) { if (!defined('NOCSRFCHECK') && isset($dolibarr_nocsrfcheck) && $dolibarr_nocsrfcheck == 1) { // If $dolibarr_nocsrfcheck is 0, there is a strict CSRF test with token in main
if (!empty($_SERVER['REQUEST_METHOD']) && !in_array($_SERVER['REQUEST_METHOD'], array('GET', 'HEAD')) && !empty($_SERVER['HTTP_HOST'])) { if (!empty($_SERVER['REQUEST_METHOD']) && !in_array($_SERVER['REQUEST_METHOD'], array('GET', 'HEAD')) && !empty($_SERVER['HTTP_HOST'])) {
$csrfattack = false; $csrfattack = false;
if (empty($_SERVER['HTTP_REFERER'])) { if (empty($_SERVER['HTTP_REFERER'])) {