Anonymous | Login
Project:
RSS
  
News | My View | View Issues | Roadmap | Summary

View Issue Details[ Jump to Notes ] [ Issue History ] [ Print ]
ID
0041748
TypeCategorySeverityReproducibilityDate SubmittedLast Update
defect[Openbravo ERP] A. Platformminorhave not tried2019-09-04 12:422019-09-26 15:10
ReportercbernerView Statuspublic 
Assigned Tocberner 
PrioritynormalResolutionfixedFixed in Version3.0PR19Q4
StatusclosedFix in branchFixed in SCM revisionabbc789f0146
ProjectionnoneETAnoneTarget Version
OSAnyDatabaseAnyJava version
OS VersionDatabase versionAnt version
Product VersionSCM revision 
Merge Request Status
Review Assigned ToAugustoMauch
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary

0041748: DeleteImageActionHandler is vulnerable to CSRF attacks

DescriptionDeleteImageActionHandler is not protected against CSRF attacks
Steps To Reproduce-
Proposed SolutionExtract code corresponding to CSRF token validation from DataSourceServlet to an utility class. Add CSRF token validation to DeleteImageActionHandler and to the call function.
TagsNo tags attached.
Attached Files

- Relationships [ Relation Graph ] [ Dependency Graph ]
related to defect 0034491 acknowledgedTriage Platform Base Review access for DeleteImageActionHandler class 
related to feature request 0039123 closedjarmendariz Add CSRF Token support 

-  Notes
(0114797)
hgbot (developer)
2019-09-26 09:47

 Repository: erp/devel/pi
Changeset: abbc789f0146476b5566216f591839f08cb65c5c
Author: Cristian Berner <cristian.berner <at> openbravo.com>
Date: Wed Sep 25 16:59:12 2019 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/abbc789f0146476b5566216f591839f08cb65c5c [^]

fixes issue 41748: Adds CSRF token verification on image deletion on new record

DeleteImageActionHandler now checks for CSRF token to make sure there's no request forgery.
CSRF checking code has been moved to CsrfUtil class from DataSourceServlet so it can be accessed from other classes.
CSRF token is sent on image deletion from ob-formitem-image only on new records.

---
M modules/org.openbravo.client.application/src/org/openbravo/client/application/DeleteImageActionHandler.java
M modules/org.openbravo.client.application/web/org.openbravo.client.application/js/form/formitem/ob-formitem-image.js
M modules/org.openbravo.service.datasource/src/org/openbravo/service/datasource/DataSourceServlet.java
A src/org/openbravo/erpCommon/utility/CsrfUtil.java
---
(0114798)
AugustoMauch (administrator)
2019-09-26 09:47

 Code reviewed and verified
(0114811)
hudsonbot (viewer)
2019-09-26 15:10

 A changeset related to this issue has been promoted main and to the
Central Repository, after passing a series of tests.

Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/409f4217568a [^]
Maturity status: Test

- Issue History
Date Modified Username Field Change
2019-09-04 12:42 cberner New Issue
2019-09-04 12:42 cberner Assigned To => platform
2019-09-04 12:42 cberner OBNetwork customer => No
2019-09-04 12:42 cberner Modules => Core
2019-09-04 12:42 cberner Triggers an Emergency Pack => No
2019-09-04 12:42 cberner Assigned To platform => cberner
2019-09-04 12:42 cberner Status new => scheduled
2019-09-04 12:43 cberner Review Assigned To => AugustoMauch
2019-09-04 12:43 cberner Relationship added related to 0034491
2019-09-04 12:43 cberner Relationship added related to 0039123
2019-09-20 10:13 AugustoMauch Description Updated View Revisions
2019-09-26 09:47 hgbot Checkin
2019-09-26 09:47 hgbot Note Added: 0114797
2019-09-26 09:47 hgbot Status scheduled => resolved
2019-09-26 09:47 hgbot Resolution open => fixed
2019-09-26 09:47 hgbot Fixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/abbc789f0146476b5566216f591839f08cb65c5c [^]
2019-09-26 09:47 AugustoMauch Note Added: 0114798
2019-09-26 09:47 AugustoMauch Status resolved => closed
2019-09-26 09:47 AugustoMauch Fixed in Version => 3.0PR19Q4
2019-09-26 15:10 hudsonbot Checkin
2019-09-26 15:10 hudsonbot Note Added: 0114811

Copyright © 2000 - 2009 MantisBT Group
Powered by Mantis Bugtracker