yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #7315 from umbraco/v8/bug/3935-useractions-xsrf-validation

Browse Source 
Adding extra validation for anti forgery tokens
This commit is contained in:
Warren Buckley
2019-12-27 12:18:25 +00:00
committed by GitHub
parent eda25d58f9 0c377a05dc
commit 48a51ea4ef
3 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Web/Mvc/ValidateMvcAngularAntiForgeryTokenAttribute.cs
View File

@@ -22,7 +22,7 @@ namespace Umbraco.Web.Mvc
var userIdentity = filterContext.HttpContext.User.Identity as ClaimsIdentity;
if (userIdentity != null)
{
//if there is not CookiePath claim, then exist
//if there is not CookiePath claim, then exit
if (userIdentity.HasClaim(x => x.Type == ClaimTypes.CookiePath) == false)
{
base.OnActionExecuting(filterContext);

3
src/Umbraco.Web/Security/BackOfficeCookieAuthenticationProvider.cs
View File

@@ -41,6 +41,9 @@ namespace Umbraco.Web.Security
: Guid.NewGuid();
backOfficeIdentity.SessionId = session.ToString();
//since it is a cookie-based authentication add that claim
backOfficeIdentity.AddClaim(new Claim(ClaimTypes.CookiePath, "/", ClaimValueTypes.String, UmbracoBackOfficeIdentity.Issuer, UmbracoBackOfficeIdentity.Issuer, backOfficeIdentity));
}
base.ResponseSignIn(context);

2
src/Umbraco.Web/WebApi/Filters/ValidateAngularAntiForgeryTokenAttribute.cs
View File

@@ -21,7 +21,7 @@ namespace Umbraco.Web.WebApi.Filters
var userIdentity = ((ApiController) actionContext.ControllerContext.Controller).User.Identity as ClaimsIdentity;
if (userIdentity != null)
{
//if there is not CookiePath claim, then exist
//if there is not CookiePath claim, then exit
if (userIdentity.HasClaim(x => x.Type == ClaimTypes.CookiePath) == false)
{
base.OnActionExecuting(actionContext);