LUTECE-2184 : Add CSRF protection to portlet creation and modification #136
Conversation
|
Not sure about this change of keeping the request in the init method for all admin features.. |
|
This necessary to avoid breaking the API and all existing portlets, while allowing existing portlets to benefit from the CSRF protection without having to opt in. |
|
@jonenst I'm not sure how to do that without breaking the API or without keeping the request accessible one way or another. Do you have an idea ? How do you suggest fixing the CSRF vulnerability which affects all portlets ? |
|
Hi Rémi, thanks for the nudge on this one. We need to decide with @pierrelevy what to do. |
|
ping @pierrelevy ? |
|
Have another idea on how to do this. Will post an updated & rebased PR shortly |
The protection is in place if portlet JspBeans call setPortletCommonData.
This allows AliasPortlets creation and modification to be CSRF protected
|
Rather than recording the request object in the base class for admin features, use the fact that spring makes the request object available (ala LocalVariables, which is redundant with Spring) |
seboo
force-pushed
the
develop
branch
3 times, most recently
from
135e4f9 to
e399c1d
Compare
No description provided.