From da7cb658df91bb573aeeb25601d117fa22179b45 Mon Sep 17 00:00:00 2001 From: Luc Didry Date: Oct 26 2018 14:03:21 +0000 Subject: Add CSRF token challenge on logout --- diff --git a/CHANGELOG b/CHANGELOG index 4be0081..35b9382 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -18,6 +18,7 @@ Revision history for Lufi - MySQL support - Display max size on upload page - Add CSRF token challenge on login + - Add CSRF token challenge on logout 0.02.2 2017-09-18 - Fix cron tasks bug diff --git a/lib/Lufi.pm b/lib/Lufi.pm index 57af3b6..3884830 100644 --- a/lib/Lufi.pm +++ b/lib/Lufi.pm @@ -112,7 +112,7 @@ sub startup { ->to('Auth#login'); # Logout page - $r->get('/logout') + $r->post('/logout') ->to('Auth#log_out') ->name('logout'); } diff --git a/lib/Lufi/Controller/Auth.pm b/lib/Lufi/Controller/Auth.pm index c7bddd1..6168309 100644 --- a/lib/Lufi/Controller/Auth.pm +++ b/lib/Lufi/Controller/Auth.pm @@ -35,7 +35,11 @@ sub log_out { my $c = shift; if ($c->is_user_authenticated) { - $c->logout; + if ($c->validation->csrf_protect->has_error('csrf_token')) { + $c->stash(msg => $c->l('Bad CSRF token.')); + } else { + $c->logout; + } } $c->render(template => 'logout'); } diff --git a/t/test.t b/t/test.t index 10a5cc1..87c9f26 100644 --- a/t/test.t +++ b/t/test.t @@ -182,7 +182,15 @@ sub auth_test_suite { test_upload_file(); test_download_file(); - $t->get_ok('/logout') + my $token = ''; + + $t->post_ok('/logout' => form => { csrf_token => $token }) + ->status_is(200) + ->content_like(qr@Bad CSRF token\.@); + + $token = $t->ua->get('/')->res->dom->find('input[name="csrf_token"]')->first->attr('value'); + + $t->post_ok('/logout' => form => { csrf_token => $token }) ->status_is(200) ->content_like(qr@You have been successfully logged out\.@); diff --git a/themes/default/lib/Lufi/I18N/ca.po b/themes/default/lib/Lufi/I18N/ca.po index 4221de6..3da48d3 100644 --- a/themes/default/lib/Lufi/I18N/ca.po +++ b/themes/default/lib/Lufi/I18N/ca.po @@ -48,7 +48,7 @@ msgstr "Un agraïment amb la foto d'un gatet a ><%= l('About') %> % if ((defined(config('ldap')) || defined(config('htpasswd'))) && is_user_authenticated()) { -
  • <%= l('Logout') %>
    • +
  • +
    + %= csrf_field + +
    +
    • % }