From c244d7375c640dca724328beb0c6350d71d20255 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 1 Oct 2021 12:30:24 +0200 Subject: [PATCH] MAIN_SECURITY_CSRF_WITH_TOKEN now has 3 levels (1, 2, 3) --- htdocs/core/class/conf.class.php | 2 +- htdocs/main.inc.php | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/htdocs/core/class/conf.class.php b/htdocs/core/class/conf.class.php index 8e43a70c3fe..e4abfc1a748 100644 --- a/htdocs/core/class/conf.class.php +++ b/htdocs/core/class/conf.class.php @@ -828,7 +828,7 @@ class Conf // Enable by default the CSRF protection by token. if (!isset($this->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) { - $this->global->MAIN_SECURITY_CSRF_WITH_TOKEN = 1; // Value 2 uses also CSRF check for all GET requests + $this->global->MAIN_SECURITY_CSRF_WITH_TOKEN = 1; // Value 2 uses also CSRF check for sensitive GET requests and 3 uses CSRF check for all POST and GET requests. // Note: Set MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL=1 to have a renewal of token at each page call instead of each session (not recommended) } diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 6f6d74c0cda..d3f30ae47f7 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -465,11 +465,11 @@ if (!defined('NOTOKENRENEWAL') && !defined('NOSESSION')) { if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN')) || defined('CSRFCHECK_WITH_TOKEN')) { // Array of action code where CSRFCHECK with token will be forced (so token must be provided on url request) $sensitiveget = false; - if ((GETPOSTISSET('massaction') || GETPOST('action', 'aZ09')) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 2) { + if ((GETPOSTISSET('massaction') || GETPOST('action', 'aZ09')) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 3) { // All GET actions and mass actions are processed as sensitive. $sensitiveget = true; - } else { - // Only GET actions coded with a &token into url are processed as sensitive. + } elseif (getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 2) { + // Few GET actions coded with a &token into url are processed as sensitive. $arrayofactiontoforcetokencheck = array( 'activate', 'add', 'addrights', 'addtimespent', 'doprev', 'donext', 'dvprev', 'dvnext',