Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Make the repository database read-only if an HTTP request is not from the same origin. This is not required for security. It is just an extra layer of defense. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
7c71f00ac8b239d4ae9cc40a74bdcf43 |
| User & Date: | drh 2022-12-29 17:00:23.937 |
Context
|
2022-12-29
| ||
| 18:56 | Add messages to the error log if the authorizer blocks an SQL statement for security reasons. This change requires a bug fix in SQLite and so it also includes the latest trunk version of SQLite. ... (check-in: 3d8bb63aab user: drh tags: trunk) | |
| 17:00 | Make the repository database read-only if an HTTP request is not from the same origin. This is not required for security. It is just an extra layer of defense. ... (check-in: 7c71f00ac8 user: drh tags: trunk) | |
|
2022-12-25
| ||
| 16:17 | A minor fix to the previous check-in. ... (check-in: abfec4dd5c user: george tags: trunk) | |
Changes
Changes to src/cgi.c.
| ︙ | ︙ | |||
678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 |
if( zRef==0 ){
zRef = P("HTTP_REFERER");
if( zRef==0 ) zRef = zDefault;
}
return zRef;
}
/*
** Return true if the current request appears to be safe from a
** Cross-Site Request Forgery (CSRF) attack. Conditions that must
** be met:
**
** * The HTTP_REFERER must have the same origin
** * The REQUEST_METHOD must be POST - or requirePost==0
*/
int cgi_csrf_safe(int requirePost){
| > > > > > > > > > > > > > > > > < < < < < < | | 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 |
if( zRef==0 ){
zRef = P("HTTP_REFERER");
if( zRef==0 ) zRef = zDefault;
}
return zRef;
}
/*
** Return true if the current request is coming from the same origin.
*/
int cgi_same_origin(void){
const char *zRef;
int nBase;
if( g.zBaseURL==0 ) return 0;
zRef = P("HTTP_REFERER");
if( zRef==0 ) return 0;
nBase = (int)strlen(g.zBaseURL);
if( fossil_strncmp(g.zBaseURL,zRef,nBase)!=0 ) return 0;
if( zRef[nBase]!=0 && zRef[nBase]!='/' ) return 0;
return 1;
}
/*
** Return true if the current request appears to be safe from a
** Cross-Site Request Forgery (CSRF) attack. Conditions that must
** be met:
**
** * The HTTP_REFERER must have the same origin
** * The REQUEST_METHOD must be POST - or requirePost==0
*/
int cgi_csrf_safe(int requirePost){
if( requirePost ){
const char *zMethod = P("REQUEST_METHOD");
if( zMethod==0 ) return 0;
if( strcmp(zMethod,"POST")!=0 ) return 0;
}
return cgi_same_origin();
}
/*
** Information about all query parameters, post parameter, cookies and
** CGI environment variables are stored in a hash table as follows:
*/
static int nAllocQP = 0; /* Space allocated for aParamQP[] */
|
| ︙ | ︙ |
Changes to src/main.c.
| ︙ | ︙ | |||
2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 |
json_bootstrap_late();
jsonOnce = 1;
}
}
#endif
if( (pCmd->eCmdFlags & CMDFLAG_RAWCONTENT)==0 ){
cgi_decode_post_parameters();
}
if( g.fCgiTrace ){
fossil_trace("######## Calling %s #########\n", pCmd->zName);
cgi_print_all(1, 1);
}
#ifdef FOSSIL_ENABLE_TH1_HOOKS
{
| > > > | 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 |
json_bootstrap_late();
jsonOnce = 1;
}
}
#endif
if( (pCmd->eCmdFlags & CMDFLAG_RAWCONTENT)==0 ){
cgi_decode_post_parameters();
if( !cgi_same_origin() ){
db_protect(PROTECT_READONLY);
}
}
if( g.fCgiTrace ){
fossil_trace("######## Calling %s #########\n", pCmd->zName);
cgi_print_all(1, 1);
}
#ifdef FOSSIL_ENABLE_TH1_HOOKS
{
|
| ︙ | ︙ |