github/myvesta
1
0
Fork 0
mirror of https://github.com/myvesta/vesta synced 2025-08-19 21:04:07 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for CSRF in FileManager and UploadHandler

Browse source
This commit is contained in:
myvesta 2021-09-04 15:31:34 +02:00
commit 93de22a0b3
6 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
web/js/app.js
View file

@ -797,6 +797,8 @@ App.Ajax.request = function(method, data, callback, onError){
}*/
//App.Helpers.setAjaxBusy(method, data);
data = data || {};
var token = $('#token').attr('token');
data.token = token;
var prgs = $('.progress-container');

13
web/js/file_manager.js
View file

@ -533,7 +533,8 @@ FM.downloadFileFromSubcontext = function(elm) {
var src = $.parseJSON($(elm).find('.source').val());
var path = src.full_path;
var win = window.open('/download/file/?path=' + path, '_blank');
var token = $('#token').attr('token');
var win = window.open('/download/file/?token='+token+'&path=' + path, '_blank');
win.focus();
}
@ -552,20 +553,21 @@ FM.openFile = function(dir, box, elm) {
};
App.Ajax.request('check_file_type', params, function(reply) {
var token = $('#token').attr('token');
if (reply.result) {
if (FM.isFileEditable(src, reply.data)) {
var myWindow = window.open('/edit/file/?path=' + src.full_path, '_blank');//, src.full_path, "width=900, height=700");
var myWindow = window.open('/edit/file/?token='+token+'&path=' + src.full_path, '_blank');//, src.full_path, "width=900, height=700");
}
else {
var path = src.full_path;
var win = window.open('/download/file/?path=' + path, '_blank');
var win = window.open('/download/file/?token='+token+'&path=' + path, '_blank');
//win.focus();
}
}
else {
// force download file
var path = src.full_path;
var win = window.open('/download/file/?path=' + path, '_blank');
var win = window.open('/download/file/?token='+token+'&path=' + path, '_blank');
//win.focus();
}
});
@ -1994,7 +1996,8 @@ FM.downloadFiles = function() {
}
var path = src.full_path;
var win = window.open('/download/file/?path=' + path, '_blank');
var token = $('#token').attr('token');
var win = window.open('/download/file/?token='+token+'&path=' + path, '_blank');
win.focus();
}