projects / GitHub / WoltLab / WCF.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 3110f74) | patch
Reject requests for `RquestHandlerInterface` implementations without a valid XSRF...
authorAlexander Ebert <ebert@woltlab.com>
Mon, 14 Nov 2022 18:28:47 +0000 (19:28 +0100)
committerAlexander Ebert <ebert@woltlab.com>
Mon, 14 Nov 2022 18:28:47 +0000 (19:28 +0100)
commit125198bcfbe87484021535a5bc3e100be1bd5e13
treec9f4fc2f4b89de19f9df3883ea1354a6f16ebc63tree | snapshot (tar.gz zip)
parent3110f7464a2812359dbf2d29d32140d6cb0217facommit | diff
Reject requests for `RquestHandlerInterface` implementations without a valid XSRF token

GET and HEAD requests are always exempt from the validation, because these are by definition safe actions (*).

(*) Legacy implementations violated this principle, but this is a bad practice and is frowned upon in new PSR implementation.
wcfsetup/install/files/lib/http/middleware/Xsrf.class.php diff | blob | blame | history
WoltLab Suite Core (previously WoltLab Community Framework)