Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0041748Openbravo ERPA. Platformpublic2019-09-04 12:422019-09-26 15:10
Reportercberner 
Assigned Tocberner 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version3.0PR19Q4 
Merge Request Status
Review Assigned ToAugustoMauch
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0041748: DeleteImageActionHandler is vulnerable to CSRF attacks
DescriptionDeleteImageActionHandler is not protected against CSRF attacks
Steps To Reproduce-
Proposed SolutionExtract code corresponding to CSRF token validation from DataSourceServlet to an utility class. Add CSRF token validation to DeleteImageActionHandler and to the call function.
Additional Information
TagsNo tags attached.
Relationships
related to defect 0034491 acknowledged Triage Platform Base Review access for DeleteImageActionHandler class 
related to feature request 0039123 closed jarmendariz Add CSRF Token support 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2019-09-04 12:42cbernerNew Issue
2019-09-04 12:42cbernerAssigned To => platform
2019-09-04 12:42cbernerOBNetwork customer => No
2019-09-04 12:42cbernerModules => Core
2019-09-04 12:42cbernerTriggers an Emergency Pack => No
2019-09-04 12:42cbernerAssigned Toplatform => cberner
2019-09-04 12:42cbernerStatusnew => scheduled
2019-09-04 12:43cbernerReview Assigned To => AugustoMauch
2019-09-04 12:43cbernerRelationship addedrelated to 0034491
2019-09-04 12:43cbernerRelationship addedrelated to 0039123
2019-09-20 10:13AugustoMauchDescription Updatedbug_revision_view_page.php?rev_id=19391#r19391
2019-09-26 09:47hgbotCheckin
2019-09-26 09:47hgbotNote Added: 0114797
2019-09-26 09:47hgbotStatusscheduled => resolved
2019-09-26 09:47hgbotResolutionopen => fixed
2019-09-26 09:47hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/abbc789f0146476b5566216f591839f08cb65c5c [^]
2019-09-26 09:47AugustoMauchNote Added: 0114798
2019-09-26 09:47AugustoMauchStatusresolved => closed
2019-09-26 09:47AugustoMauchFixed in Version => 3.0PR19Q4
2019-09-26 15:10hudsonbotCheckin
2019-09-26 15:10hudsonbotNote Added: 0114811

Notes
(0114797)
hgbot   
2019-09-26 09:47   
Repository: erp/devel/pi
Changeset: abbc789f0146476b5566216f591839f08cb65c5c
Author: Cristian Berner <cristian.berner <at> openbravo.com>
Date: Wed Sep 25 16:59:12 2019 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/abbc789f0146476b5566216f591839f08cb65c5c [^]

fixes issue 41748: Adds CSRF token verification on image deletion on new record

DeleteImageActionHandler now checks for CSRF token to make sure there's no request forgery.
CSRF checking code has been moved to CsrfUtil class from DataSourceServlet so it can be accessed from other classes.
CSRF token is sent on image deletion from ob-formitem-image only on new records.

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/DeleteImageActionHandler.java
M modules/org.openbravo.client.application/web/org.openbravo.client.application/js/form/formitem/ob-formitem-image.js
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceServlet.java
A src/org/openbravo/erpCommon/utility/CsrfUtil.java
---
(0114798)
AugustoMauch   
2019-09-26 09:47   
Code reviewed and verified
(0114811)
hudsonbot   
2019-09-26 15:10   
A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/409f4217568a [^]
Maturity status: Test