[checkmk-commits] [tribe29/checkmk] a83fa6: 13903 SEC Introduce additional CSRF checks

Branch: refs/heads/2.1.0 Home: https://github.com/tribe29/checkmk Commit: a83fa6ef0cfa3e85e2eed21de9b0c33178b7eb3a https://github.com/tribe29/checkmk/commit/a83fa6ef0cfa3e85e2eed21de9b0c3317… Author: Maximilian Wirtz <maximilian.wirtz(a)tribe29.com> Date: 2022-06-01 (Wed, 01 Jun 2022) Changed paths: A .werks/13903 M cmk/gui/htmllib/__init__.py M cmk/gui/node_visualization.py M cmk/gui/pages.py M cmk/gui/sidebar/__init__.py M cmk/gui/type_defs.py A cmk/gui/utils/csrf_token.py M cmk/gui/valuespec.py M cmk/gui/views/__init__.py M cmk/gui/wato/pages/activate_changes.py M cmk/gui/wato/pages/folders.py M cmk/gui/wato/pages/host_diagnose.py M cmk/gui/wato/pages/services.py M cmk/gui/wato/pages/user_profile/async_replication.py M cmk/gui/wato/pages/user_profile/mega_menu.py M tests/unit/cmk/gui/test_userdb.py M web/htdocs/js/modules/ajax.js M web/htdocs/js/modules/dashboard.js M web/htdocs/js/modules/host_diagnose.js M web/htdocs/js/modules/service_discovery.js M web/htdocs/js/modules/sidebar.js Log Message: ----------- 13903 SEC Introduce additional CSRF checks This is the pick of two changes: - I5539eb30520efa10f77c17c64a29c67bf1af39f3 - Ic709514c4e0f00c1aeeeede8aaf4c388007fcd7a Previously the mitigation for CSRF were the transaction ids. Since they are not used everywhere and not usable everywhere a new mitigation is implemented. The CSRF token is bound on the server side to the session and is a UUID. It is written to every page as a JavaScript variable and included in all forms as a hidden field. The Page class now has a method to validate the existence and correctness of this CSRF token and will raise an error if no token or an invalid one is provided. If no session context is present, no token is written and none is checked! Change-Id: Ic709514c4e0f00c1aeeeede8aaf4c388007fcd7a