Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
113132 commits 1 branch 0 tags 744 MiB
Commit graph

8 commits

Author SHA1 Message Date
Daimona Eaytoy
3b81a1ef27 Add TokenAwareHandlerTrait for handlers supporting CSRF-unsafe providers 
Returning a known-good token is not part of the trait method because I
think handlers other than the ones based on the action API wouldn't even
need a token if the session is safe against CSRF.

Bug: T305043
Change-Id: If41749722b28c8c0e9898b3d3e7937167653fb10
 2022-05-25 02:07:36 +00:00
Bill Pirkle
7295100773 Allow REST API handlers to require csrf-safe session providers 
Bug: T305043
Depends-On: Ic7c1b19b86e8a151e2d42aaec00ef0e89db77f08
Change-Id: Ic6bd48b400ecd839ef99b518ef955781470cd05c
 2022-05-20 16:52:54 +00:00
Aryeh Gregor
666ca1bdf3 Use MainConfigNames instead of string literals, #2 
This covers all occurrences of /onfig->.*get( '/ in includes/.
Undoubtedly there are still plenty more to go.

Change-Id: I33196c4153437778496f40436bcde399638ac361
 2022-04-13 18:55:46 +03:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source" 
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
 2021-08-05 15:48:26 -07:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source 
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
 2021-07-12 14:19:15 -07:00
daniel
d2d2906ce7 REST /page/{title}: Fix title encoding. 
Page titles used in URL paths, such as the Location header returned
after a page was created, must use the correct encoding for spaces and
pluses.

Bug: T258606
Change-Id: I75e91ac8f8da4eb183a9c8f1a682ea08c2225227
 2020-07-23 23:17:17 +02:00
daniel
905f6fc890 REST: page/ endpoints: don't use tokens with OAuth 
CSRF tokens should only be required (and only be allowed) if
the current session isn't already inherently safe against
CSRF due to the way the authentication mechanism works.
This allows (and requires) tokens to be omitted for requests
that use an OAuth Authorization header.

Bug: T230843
Bug: T230842
Bug: T237852
Change-Id: Ib2922d556ff2470d4bf8c386c18986ca9f37d1b5
 2020-03-27 12:20:22 +01:00
daniel
65342f8353 Define POST handler for /page/: create page 
NOTE: once this is merged, also merge Ie7b47e6868cc on the OAuth repo,
to fix unit tests after a breaking change to Router's constructor
signature.

Bug: T230842
Change-Id: I8f5b92918a58e44a4f2d8c78d234d9f64c2d06bf
 2020-03-25 20:49:20 +01:00