lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MAIN_SECURITY_CSRF_WITH_TOKEN now has 3 levels (1, 2, 3)

Browse Source
This commit is contained in:
Laurent Destailleur 2021-10-01 12:30:24 +02:00
parent 7f8d5adb6c
commit c244d7375c
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/class/conf.class.php
View File

@ -828,7 +828,7 @@ class Conf
// Enable by default the CSRF protection by token.
if (!isset($this->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) {
$this->global->MAIN_SECURITY_CSRF_WITH_TOKEN = 1; // Value 2 uses also CSRF check for all GET requests
$this->global->MAIN_SECURITY_CSRF_WITH_TOKEN = 1; // Value 2 uses also CSRF check for sensitive GET requests and 3 uses CSRF check for all POST and GET requests.
// Note: Set MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL=1 to have a renewal of token at each page call instead of each session (not recommended)
}

6
htdocs/main.inc.php
View File

@ -465,11 +465,11 @@ if (!defined('NOTOKENRENEWAL') && !defined('NOSESSION')) {
if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN')) || defined('CSRFCHECK_WITH_TOKEN')) {
// Array of action code where CSRFCHECK with token will be forced (so token must be provided on url request)
$sensitiveget = false;
if ((GETPOSTISSET('massaction') || GETPOST('action', 'aZ09')) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 2) {
if ((GETPOSTISSET('massaction') || GETPOST('action', 'aZ09')) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 3) {
// All GET actions and mass actions are processed as sensitive.
$sensitiveget = true;
} else {
// Only GET actions coded with a &token into url are processed as sensitive.
} elseif (getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 2) {
// Few GET actions coded with a &token into url are processed as sensitive.
$arrayofactiontoforcetokencheck = array(
'activate', 'add', 'addrights', 'addtimespent',
'doprev', 'donext', 'dvprev', 'dvnext',