|
Lines 49-54
If the HTTP request method is safe (GET, HEAD, OPTIONS, TRACE) and the request
Link Here
|
| 49 |
contains an `op` parameter whose value starts with "cud-" (which means it's a |
49 |
contains an `op` parameter whose value starts with "cud-" (which means it's a |
| 50 |
Create, Update or Delete operation), it will immediately return a 400 response. |
50 |
Create, Update or Delete operation), it will immediately return a 400 response. |
| 51 |
|
51 |
|
|
|
52 |
If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and |
| 53 |
the request contains an `op` parameter whose value does not start with "cud-", |
| 54 |
it will immediately return a 400 response. |
| 55 |
|
| 52 |
If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and |
56 |
If the HTTP request method is unsafe (POST, PUT, DELETE, PATCH, CONNECT) and |
| 53 |
the CGISESSID cookie is set, the CSRF token is checked. A 403 response is |
57 |
the CGISESSID cookie is set, the CSRF token is checked. A 403 response is |
| 54 |
immediately returned if the CSRF token is missing or invalid. |
58 |
immediately returned if the CSRF token is missing or invalid. |
|
Lines 69-77
sub register {
Link Here
|
| 69 |
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { |
73 |
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) { |
| 70 |
my $op = $c->req->param('op'); |
74 |
my $op = $c->req->param('op'); |
| 71 |
if ( $op && $op =~ /^cud-/ ) { |
75 |
if ( $op && $op =~ /^cud-/ ) { |
| 72 |
return $c->reply->exception('Incorrect use of a safe HTTP method with a "cud-" op parameter')->rendered(400); |
76 |
return $c->reply->exception('Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')->rendered(400); |
| 73 |
} |
77 |
} |
| 74 |
} else { |
78 |
} else { |
|
|
79 |
my $op = $c->req->param('op'); |
| 80 |
if ( $op && $op !~ /^cud-/ ) { |
| 81 |
return $c->reply->exception('Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')->rendered(400); |
| 82 |
} |
| 83 |
|
| 75 |
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { |
84 |
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) { |
| 76 |
return $c->reply->exception('Wrong CSRF token')->rendered(403); |
85 |
return $c->reply->exception('Wrong CSRF token')->rendered(403); |
| 77 |
} |
86 |
} |