fix: csrf check failed on public share with password#44369
fix: csrf check failed on public share with password#44369juliusknorr merged 3 commits intomasterfrom
Conversation
core/js/publicshareauth.js
Outdated
| document.addEventListener('DOMContentLoaded', function() { | ||
| var form = document.getElementById('password-input-form'); | ||
| if (form) { | ||
| form.addEventListener('submit', async function(event) { | ||
| event.preventDefault(); | ||
| var requestToken = document.getElementById('requesttoken'); | ||
| if (requestToken) { | ||
| requestToken.value = await OC.fetchRequestToken(); | ||
| } | ||
| form.submit(); | ||
| }); | ||
| } | ||
| }); |
There was a problem hiding this comment.
would it be possible to move this into a "modern" js module that goes through webpack? then you can import @nextcloud/router directly and we avoid adding a new property to the dated OC global
ChristophWurst
requested review from
a team,
Pytal,
emoral435 and
szaimen
and removed request for
a team
| if (requestToken) { | ||
| const url = generateUrl('/csrftoken') | ||
| const resp = await Axios.get(url) | ||
| requestToken.value = resp.data.token | ||
| } |
There was a problem hiding this comment.
Could use grab the currently known CSRF token from @nextcloud/auth to avoid the additional request?
There was a problem hiding this comment.
This PR is for solving issue that the currently known CSRF token might not be the latest.
There was a problem hiding this comment.
There is an existing CSRF token update mechanism that pulls a fresh token every 30 seconds. Is that not sufficient?
There was a problem hiding this comment.
I think it is not sufficient. User might submit form during the gap time and see the CSRF failed error randomly.
emoral435
left a comment
emoral435
left a comment
There was a problem hiding this comment.
This looks like a valid solution to me - however, haven't tested it fully
Signed-off-by: Luka Trovic <luka@nextcloud.com>
Signed-off-by: Luka Trovic <luka@nextcloud.com>
Signed-off-by: Luka Trovic <luka@nextcloud.com>
luka-nextcloud
force-pushed
the
bugfix/csrf-failed-on-public-share-with-password
branch
from
6d5b7ea to
a42c68d
Compare
|
@juliushaertl @ChristophWurst @Altahrim This PR was missed from the release. |
|
/backport to stable29 |
6 participants
Summary
"CSRF check failed" on public share with password
TODO
Checklist