Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: update csrf parser to accept csrf_token form value if present

Browse Source
This commit is contained in:
psibean
2023-02-17 15:19:41 -05:00
committed by Julian Lam
parent cc147ab31d
commit ea95668a76
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/middleware/csrf.js
View File

@@ -9,8 +9,8 @@ const {
getTokenFromRequest: (req) => { getTokenFromRequest: (req) => {
if (req.headers['x-csrf-token']) { if (req.headers['x-csrf-token']) {
return req.headers['x-csrf-token']; return req.headers['x-csrf-token'];
} else if (req.query) { } else if (req.body.csrf_token) {
return req.query._csrf; return req.body.csrf_token;
} }
}, },
size: 64, size: 64,

2
src/routes/authentication.js
View File

@@ -172,7 +172,7 @@ Auth.reloadRoutes = async function (params) {
router.post('/register', middlewares, controllers.authentication.register); router.post('/register', middlewares, controllers.authentication.register);
router.post('/register/complete', middlewares, controllers.authentication.registerComplete); router.post('/register/complete', middlewares, controllers.authentication.registerComplete);
router.post('/register/abort', Auth.middleware.applyCSRF, controllers.authentication.registerAbort); router.post('/register/abort', middlewares, controllers.authentication.registerAbort);
router.post('/login', Auth.middleware.applyCSRF, Auth.middleware.applyBlacklist, controllers.authentication.login); router.post('/login', Auth.middleware.applyCSRF, Auth.middleware.applyBlacklist, controllers.authentication.login);
router.post('/logout', Auth.middleware.applyCSRF, controllers.authentication.logout); router.post('/logout', Auth.middleware.applyCSRF, controllers.authentication.logout);
}; };