ajet/gitea
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace CSRF cookie with CrossOriginProtection (#36183)

Browse Source 
Removes the CSRF cookie in favor of
[`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection)
which relies purely on HTTP headers.

Fixes: https://github.com/go-gitea/gitea/issues/11188
Fixes: https://github.com/go-gitea/gitea/issues/30333
Helps: https://github.com/go-gitea/gitea/issues/35107

TODOs:

- [x] Fix tests
- [ ] Ideally add tests to validates the protection

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
silverwind
2025-12-25 11:33:34 +01:00
committed by GitHub
parent eddf875992
commit 42d294941c
207 changed files with 178 additions and 1196 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/org/create.tmpl
-1
View File
@@ -7,7 +7,6 @@
</h3>
<div class="ui attached segment">
<form class="ui form left-right-form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<div class="inline required field {{if .Err_OrgName}}error{{end}}">
<label for="org_name">{{ctx.Locale.Tr "org.org_name_holder"}}</label>
<input id="org_name" name="org_name" value="{{.org_name}}" autofocus required maxlength="40">
templates/org/settings/options.tmpl
-2
View File
@@ -6,7 +6,6 @@
</h4>
<div class="ui attached segment">
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}
<div class="field {{if .Err_FullName}}error{{end}}">
<label for="full_name">{{ctx.Locale.Tr "org.org_full_name_holder"}}</label>
<input id="full_name" name="full_name" value="{{.Org.FullName}}" maxlength="100">
@@ -57,7 +56,6 @@
<div class="divider"></div>
<form class="ui form" action="{{.Link}}/avatar" method="post" enctype="multipart/form-data">
{{.CsrfTokenHtml}}
<div class="inline field">
{{template "shared/avatar_upload_crop" dict "LabelText" (ctx.Locale.Tr "settings.choose_new_avatar")}}
</div>
templates/org/settings/options_dangerzone.tmpl
-3
View File
@@ -47,7 +47,6 @@
</ul>
</div>
<form class="ui form form-fetch-action" action="{{.Link}}/visibility" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="current_visibility" value="{{.CurrentVisibility}}">
<div class="tw-flex tw-flex-col tw-gap-3">
<label>{{ctx.Locale.Tr "org.settings.visibility"}}</label>
@@ -85,7 +84,6 @@
</ul>
</div>
<form class="ui form form-fetch-action" action="{{.Link}}/rename" method="post">
{{.CsrfTokenHtml}}
<div class="field">
<label>
{{ctx.Locale.Tr "org.settings.name_confirm"}}
@@ -124,7 +122,6 @@
</ul>
</div>
<form class="ui form form-fetch-action" action="{{.Link}}/delete" method="post">
{{.CsrfTokenHtml}}
<div class="field">
<label>
{{ctx.Locale.Tr "org.settings.name_confirm"}}
templates/org/team/invite.tmpl
-1
View File
@@ -13,7 +13,6 @@
</div>
<div class="extra content">
<form class="ui form" action="" method="post">
{{.CsrfTokenHtml}}
<button class="fluid ui primary button">{{ctx.Locale.Tr "org.teams.join"}}</button>
</form>
</div>
templates/org/team/members.tmpl
-2
View File
@@ -10,7 +10,6 @@
{{if .IsOrganizationOwner}}
<div class="ui top attached segment">
<form class="ui form ignore-dirty tw-flex tw-flex-wrap tw-gap-2" action="{{$.OrgLink}}/teams/{{$.Team.LowerName | PathEscape}}/action/add" method="post">
{{.CsrfTokenHtml}}
<input type="hidden" name="uid" value="{{.SignedUser.ID}}">
<div id="search-user-box" class="ui search tw-mr-2"{{if .IsEmailInviteEnabled}} data-allow-email="true" data-allow-email-description="{{ctx.Locale.Tr "org.teams.invite_team_member" $.Team.Name}}"{{end}}>
<div class="ui input">
@@ -62,7 +61,6 @@
</div>
<div class="flex-item-trailing">
<form action="{{$.OrgLink}}/teams/{{$.Team.LowerName | PathEscape}}/action/remove_invite" method="post">
{{$.CsrfTokenHtml}}
<input type="hidden" name="iid" value="{{.ID}}">
<button class="ui red button">{{ctx.Locale.Tr "org.members.remove"}}</button>
</form>
templates/org/team/new.tmpl
-1
View File
@@ -5,7 +5,6 @@
<div class="ui grid">
<div class="column">
<form class="ui form" action="{{if .PageIsOrgTeamsNew}}{{.OrgLink}}/teams/new{{else}}{{.OrgLink}}/teams/{{.Team.LowerName | PathEscape}}/edit{{end}}" data-delete-url="{{.OrgLink}}/teams/{{.Team.LowerName | PathEscape}}/delete" method="post">
{{.CsrfTokenHtml}}
<h3 class="ui top attached header">
{{if .PageIsOrgTeamsNew}}{{ctx.Locale.Tr "org.create_new_team"}}{{else}}{{ctx.Locale.Tr "org.teams.settings"}}{{end}}
</h3>
templates/org/team/repositories.tmpl
-2
View File
@@ -11,7 +11,6 @@
{{if $canAddRemove}}
<div class="ui top attached segment tw-flex tw-flex-wrap tw-gap-2">
<form class="ui form ignore-dirty tw-flex-1 tw-flex" action="{{$.OrgLink}}/teams/{{$.Team.LowerName | PathEscape}}/action/repo/add" method="post">
{{.CsrfTokenHtml}}
<div data-global-init="initSearchRepoBox" data-uid="{{.Org.ID}}" class="ui search">
<div class="ui input">
<input class="prompt" name="repo_name" placeholder="{{ctx.Locale.Tr "search.repo_kind"}}" autocomplete="off" required>
@@ -40,7 +39,6 @@
<div class="flex-item-trailing">
{{if $canAddRemove}}
<form method="post" action="{{$.OrgLink}}/teams/{{$.Team.LowerName | PathEscape}}/action/repo/remove">
{{$.CsrfTokenHtml}}
<button type="submit" class="ui red small button" name="repoid" value="{{.ID}}">{{ctx.Locale.Tr "remove"}}</button>
</form>
{{end}}
templates/org/team/sidebar.tmpl
-1
View File
@@ -10,7 +10,6 @@
</form>
{{else if .IsOrganizationOwner}}
<form method="post" action="{{.OrgLink}}/teams/{{.Team.LowerName | PathEscape}}/action/join">
{{$.CsrfTokenHtml}}
<input type="hidden" name="page" value="team">
<button type="submit" class="ui primary tiny button" name="uid" value="{{$.SignedUser.ID}}">{{ctx.Locale.Tr "org.teams.join"}}</button>
</form>
templates/org/team/teams.tmpl
-1
View File
@@ -25,7 +25,6 @@
</form>
{{else if $.IsOrganizationOwner}}
<form method="post" action="{{$.OrgLink}}/teams/{{.LowerName | PathEscape}}/action/join">
{{$.CsrfTokenHtml}}
<button type="submit" class="ui primary tiny button" name="uid" value="{{$.SignedUser.ID}}">{{ctx.Locale.Tr "org.teams.join"}}</button>
</form>
{{end}}