Attachment 165545 Details for Bug 35106 – Bug 35106: CSRF fix

[patch] Bug 35106: CSRF fix

Bug-35106-CSRF-fix.patch (text/plain), 1.25 KB, created by Tomás Cohen Arazi (tcohen) on 2024-04-25 13:59:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2024-04-25 13:59:15 UTC

Size: 1.25 KB

patch

obsolete

>From a71d63d20b8e7955c576c5505916b69c04152785 Mon Sep 17 00:00:00 2001
>From: Pedro Amorim <pedro.amorim@ptfs-europe.com>
>Date: Tue, 2 Apr 2024 11:28:59 +0000
>Subject: [PATCH] Bug 35106: CSRF fix
>
>The removal of 'cud-' from op needs to happen sooner
>because ill-requests.tt expects 'edit_action' op,
>not 'cud-edit_action'.
>
>Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> ill/ill-requests.pl | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl
>index 98d4e77c57a..0d8e7b186ea 100755
>--- a/ill/ill-requests.pl
>+++ b/ill/ill-requests.pl
>@@ -216,6 +216,7 @@ if ( $backends_available ) {
>         handle_commit_maybe($backend_result, $request);
> 
>     } elsif ( $op eq 'cud-edit_action' ) {
>+        $op =~ s/^cud-//;
>         # Handle edits to the Illrequest object.
>         # (not the Illrequestattributes)
>         # We simulate the API for backend requests for uniformity.
>@@ -225,7 +226,6 @@ if ( $backends_available ) {
>             order_by => { -asc => 'name' }
>         });
>         if ( !$params->{stage} ) {
>-            $op =~ s/^cud-//;
>             my $backend_result = {
>                 error   => 0,
>                 status  => '',
>-- 
>2.44.0

Actions: View | Diff | Splinter Review

Attachments on bug 35106: 157421 | 157422 | 157498 | 157499 | 159934 | 159935 | 164258 | 164259 | 164260 | 165543 | 165544 | 165545