Replace CSRF cookie with CrossOriginProtection (#36183)
Removes the CSRF cookie in favor of [`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection) which relies purely on HTTP headers. Fixes: https://github.com/go-gitea/gitea/issues/11188 Fixes: https://github.com/go-gitea/gitea/issues/30333 Helps: https://github.com/go-gitea/gitea/issues/35107 TODOs: - [x] Fix tests - [ ] Ideally add tests to validates the protection --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
silverwind
@@ -6,7 +6,6 @@
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{template "base/disable_form_autofill"}}
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="update">
|
||||
<div class="required field {{if .Err_RepoName}}error{{end}}">
|
||||
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
|
||||
@@ -38,7 +37,6 @@
|
||||
|
||||
<div class="divider"></div>
|
||||
<form class="ui form" action="{{.Link}}/avatar" method="post" enctype="multipart/form-data">
|
||||
{{.CsrfTokenHtml}}
|
||||
<div class="inline field">
|
||||
{{template "shared/avatar_upload_crop" dict "LabelText" (ctx.Locale.Tr "settings.choose_new_avatar")}}
|
||||
</div>
|
||||
@@ -119,7 +117,6 @@
|
||||
<td>{{DateUtils.FullTime .PullMirror.UpdatedUnix}}</td>
|
||||
<td class="tw-text-right">
|
||||
<form method="post" class="tw-inline-block">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="mirror-sync">
|
||||
<button class="ui primary tiny button inline">{{ctx.Locale.Tr "repo.settings.sync_mirror"}}</button>
|
||||
</form>
|
||||
@@ -129,7 +126,6 @@
|
||||
<td colspan="4">
|
||||
<form class="ui form" method="post">
|
||||
{{template "base/disable_form_autofill"}}
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="mirror">
|
||||
<div class="inline field {{if .Err_EnablePrune}}error{{end}}">
|
||||
<label>{{ctx.Locale.Tr "repo.mirror_prune"}}</label>
|
||||
@@ -226,13 +222,11 @@
|
||||
{{svg "octicon-pencil" 14}}
|
||||
</button>
|
||||
<form method="post" class="tw-inline-block">
|
||||
{{$.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="push-mirror-sync">
|
||||
<input type="hidden" name="push_mirror_id" value="{{.ID}}">
|
||||
<button class="ui primary tiny button" data-tooltip-content="{{ctx.Locale.Tr "repo.settings.sync_mirror"}}">{{svg "octicon-sync" 14}}</button>
|
||||
</form>
|
||||
<form method="post" class="tw-inline-block">
|
||||
{{$.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="push-mirror-remove">
|
||||
<input type="hidden" name="push_mirror_id" value="{{.ID}}">
|
||||
<button class="ui basic red tiny button" data-tooltip-content="{{ctx.Locale.Tr "remove"}}">{{svg "octicon-trash" 14}}</button>
|
||||
@@ -249,7 +243,6 @@
|
||||
<td colspan="4">
|
||||
<form class="ui form" method="post">
|
||||
{{template "base/disable_form_autofill"}}
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="push-mirror-add">
|
||||
<div class="field {{if .Err_PushMirrorAddress}}error{{end}}">
|
||||
<label for="push_mirror_address">{{ctx.Locale.Tr "repo.settings.mirror_settings.push_mirror.remote_url"}}</label>
|
||||
@@ -299,7 +292,6 @@
|
||||
</h4>
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="advanced">
|
||||
|
||||
{{$isCodeEnabled := .Repository.UnitEnabled ctx ctx.Consts.RepoUnitTypeCode}}
|
||||
@@ -647,7 +639,6 @@
|
||||
</h4>
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="signing">
|
||||
<div class="field">
|
||||
<label>{{ctx.Locale.Tr "repo.settings.trust_model"}}</label><br>
|
||||
@@ -694,7 +685,6 @@
|
||||
</h4>
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="admin">
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
@@ -710,7 +700,6 @@
|
||||
|
||||
<div class="divider"></div>
|
||||
<form class="ui form" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="admin_index">
|
||||
{{if .IsRepoIndexerEnabled}}
|
||||
<h4 class="ui header">{{ctx.Locale.Tr "repo.settings.admin_code_indexer"}}</h4>
|
||||
@@ -815,7 +804,6 @@
|
||||
<div class="flex-item-trailing">
|
||||
{{if .RepoTransfer}}
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="cancel_transfer">
|
||||
<button class="ui red button">{{ctx.Locale.Tr "repo.settings.transfer_abort"}}</button>
|
||||
</form>
|
||||
@@ -883,7 +871,6 @@
|
||||
{{ctx.Locale.Tr "repo.settings.convert_notices_1"}}
|
||||
</div>
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="convert">
|
||||
<div class="field">
|
||||
<label>
|
||||
@@ -914,7 +901,6 @@
|
||||
{{ctx.Locale.Tr "repo.settings.convert_fork_notices_1"}}
|
||||
</div>
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="convert_fork">
|
||||
<div class="field">
|
||||
<label>
|
||||
@@ -947,7 +933,6 @@
|
||||
{{ctx.Locale.Tr "repo.settings.transfer_notices_4"}}
|
||||
</div>
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="transfer">
|
||||
<div class="field">
|
||||
<label>
|
||||
@@ -985,7 +970,6 @@
|
||||
{{end}}
|
||||
</div>
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="delete">
|
||||
<div class="field">
|
||||
<label>
|
||||
@@ -1026,7 +1010,6 @@
|
||||
{{end}}
|
||||
</div>
|
||||
<form action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="visibility">
|
||||
<input type="hidden" name="repo_id" value="{{.Repository.ID}}">
|
||||
{{template "base/modal_actions_confirm" .}}
|
||||
@@ -1045,7 +1028,6 @@
|
||||
{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name}}
|
||||
</div>
|
||||
<form class="ui form" action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="delete-wiki">
|
||||
<div class="field">
|
||||
<label>
|
||||
@@ -1086,7 +1068,6 @@
|
||||
</p>
|
||||
</div>
|
||||
<form action="{{.Link}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<input type="hidden" name="action" value="{{if .Repository.IsArchived}}unarchive{{else}}archive{{end}}">
|
||||
<input type="hidden" name="repo_id" value="{{.Repository.ID}}">
|
||||
{{template "base/modal_actions_confirm" .}}
|
||||
|
||||
Reference in New Issue
Block a user