github/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent synced 2025-07-14 09:13:08 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Add option to control CSRF protection

Browse source 
Some users are using WebUI with simple port-forwarding from their router,
providing an option to control the protection will save them from setting up an
non-trival web proxy.
Closes #7274.
This commit is contained in:
Chocobo1 2018-05-22 00:43:33 +08:00
parent bad4d94f77
commit 9eeef0be97
No known key found for this signature in database
GPG key ID: 210D9C873253A68C
8 changed files with 37 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/webui/webapplication.cpp
View file

@ -430,6 +430,7 @@ void WebApplication::configure()
}
m_isClickjackingProtectionEnabled = pref->isWebUiClickjackingProtectionEnabled();
m_isCSRFProtectionEnabled = pref->isWebUiCSRFProtectionEnabled();
}
void WebApplication::registerAPIController(const QString &scope, APIController *controller)
@ -514,9 +515,11 @@ Http::Response WebApplication::processRequest(const Http::Request &request, cons
clear();
try {
// block cross-site requests
if (isCrossSiteRequest(m_request) || !validateHostHeader(m_domainList))
// block suspicious requests
if ((m_isCSRFProtectionEnabled && isCrossSiteRequest(m_request))
|| !validateHostHeader(m_domainList)) {
throw UnauthorizedHTTPError();
}
sessionInitialize();
doProcessRequest();