Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-07 23:00:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

respect token validation mode for CSRF header

Browse Source 
Fixes #1104

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2022-12-16 19:14:56 +01:00
parent 2da3eabc12
commit 147ad3b230
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
internal/httpd/middleware.go
View File

@@ -305,10 +305,12 @@ func verifyCSRFHeader(next http.Handler) http.Handler {
return return
} }
if !util.Contains(token.Audience(), util.GetIPFromRemoteAddress(r.RemoteAddr)) { if tokenValidationMode != tokenValidationNoIPMatch {
logger.Debug(logSender, "", "error validating CSRF header IP audience") if !util.Contains(token.Audience(), util.GetIPFromRemoteAddress(r.RemoteAddr)) {
sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden) logger.Debug(logSender, "", "error validating CSRF header IP audience")
return sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden)
return
}
} }
next.ServeHTTP(w, r) next.ServeHTTP(w, r)