github/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent synced 2025-08-20 21:33:27 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[WebUI] relax CSRF defense. Closes #6882.

Browse source 
Allow HTTP request which has neither Origin nor Referer header included
This commit is contained in:
Chocobo1 2017-06-02 18:17:51 +08:00 • committed by sledgehammer999
commit 8d2fb06f65
No known key found for this signature in database
GPG key ID: 6E4A2D025B7CC9A2
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/webui/abstractwebapplication.cpp
View file

@ -396,9 +396,9 @@ bool AbstractWebApplication::isCrossSiteRequest(const Http::Request &request) co
const QString refererValue = request.headers.value(Http::HEADER_REFERER); const QString refererValue = request.headers.value(Http::HEADER_REFERER);
if (originValue.isEmpty() && refererValue.isEmpty()) { if (originValue.isEmpty() && refererValue.isEmpty()) {
if ((request.path == QLatin1String("/")) || (request.path == QLatin1String("/favicon.ico"))) // owasp.org recommends to block this request, but doing so will inevitably lead Web API users to spoof headers
return false; // normal request // so lets be permissive here
return true; return false;
} }
// sent with CORS requests, as well as with POST requests // sent with CORS requests, as well as with POST requests