Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

MAIN_SECURITY_CSRF_WITH_TOKEN now has 3 levels (1, 2, 3)

Browse Source
This commit is contained in:
Laurent Destailleur 2021-10-01 12:37:32 +02:00
parent c244d7375c
commit c664b78800
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/core/class/conf.class.php
View File

@ -828,7 +828,10 @@ class Conf
// Enable by default the CSRF protection by token.
if (!isset($this->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) {
$this->global->MAIN_SECURITY_CSRF_WITH_TOKEN = 1; // Value 2 uses also CSRF check for sensitive GET requests and 3 uses CSRF check for all POST and GET requests.
// Value 1 makes CSRF check for all POST parameters only
// Value 2 makes also CSRF check for GET requests with action = a sensitive requests like action=del, action=remove...
// Value 3 makes also CSRF check for all GET requests with a param action or massaction
$this->global->MAIN_SECURITY_CSRF_WITH_TOKEN = 1;
// Note: Set MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL=1 to have a renewal of token at each page call instead of each session (not recommended)
}

4
htdocs/main.inc.php
View File

@ -465,10 +465,10 @@ if (!defined('NOTOKENRENEWAL') && !defined('NOSESSION')) {
if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN')) || defined('CSRFCHECK_WITH_TOKEN')) {
// Array of action code where CSRFCHECK with token will be forced (so token must be provided on url request)
$sensitiveget = false;
if ((GETPOSTISSET('massaction') || GETPOST('action', 'aZ09')) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 3) {
if ((GETPOSTISSET('massaction') || GETPOST('action', 'aZ09')) && getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') >= 3) {
// All GET actions and mass actions are processed as sensitive.
$sensitiveget = true;
} elseif (getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') == 2) {
} elseif (getDolGlobalInt('MAIN_SECURITY_CSRF_WITH_TOKEN') >= 2) {
// Few GET actions coded with a &token into url are processed as sensitive.
$arrayofactiontoforcetokencheck = array(
'activate', 'add', 'addrights', 'addtimespent',