s434730/RandomSec
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix Wikidata login CSRF issue. Closes #2228.

Browse Source
This commit is contained in:
Antonin Delpeuch 2019-12-25 11:02:19 +01:00
parent 4edbd40b6a
commit fe57897e8e
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
extensions/wikidata/src/org/openrefine/wikidata/commands/LoginCommand.java
View File

@ -45,7 +45,11 @@ public class LoginCommand extends Command {
respondCSRFError(response); respondCSRFError(response);
return; return;
} }
respond(request, response);
}
protected void respond(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String username = request.getParameter("wb-username"); String username = request.getParameter("wb-username");
String password = request.getParameter("wb-password"); String password = request.getParameter("wb-password");
String remember = request.getParameter("remember-credentials"); String remember = request.getParameter("remember-credentials");
@ -74,6 +78,6 @@ public class LoginCommand extends Command {
@Override @Override
public void doGet(HttpServletRequest request, HttpServletResponse response) public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException { throws ServletException, IOException {
doPost(request, response); respond(request, response);
} }
} }

6
extensions/wikidata/tests/src/org/openrefine/wikidata/commands/LoginCommandTest.java
View File

@ -34,4 +34,10 @@ public class LoginCommandTest extends CommandTest {
command.doPost(request, response); command.doPost(request, response);
TestUtils.assertEqualAsJson("{\"code\":\"error\",\"message\":\"Missing or invalid csrf_token parameter\"}", writer.toString()); TestUtils.assertEqualAsJson("{\"code\":\"error\",\"message\":\"Missing or invalid csrf_token parameter\"}", writer.toString());
} }
@Test
public void testGetNotCsrfProtected() throws ServletException, IOException {
command.doGet(request, response);
TestUtils.assertEqualAsJson("{\"logged_in\":false,\"username\":null}", writer.toString());
}
} }