Page MenuHomePhabricator

Fix a CSRF issue with adding new email addresses
ClosedPublic

Authored by epriestley on Jun 30 2016, 3:25 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Dec 15, 1:59 PM
Unknown Object (File)
Mon, Dec 9, 4:51 PM
Unknown Object (File)
Mon, Dec 9, 2:45 AM
Unknown Object (File)
Tue, Dec 3, 4:42 PM
Unknown Object (File)
Tue, Dec 3, 4:42 PM
Unknown Object (File)
Tue, Dec 3, 4:42 PM
Unknown Object (File)
Tue, Dec 3, 4:27 PM
Unknown Object (File)
Nov 21 2024, 1:02 PM
Subscribers
None

Details

Summary

The first dialog was being given the wrong user ($user, should be $viewer), leading to a CSRF issue.

(The CSRF token it generated was invalid in all validation contexts, so this wasn't a security problem or a way to capture CSRF tokens for other users.)

Use newDialog() instead.

(This seems completely unrelated to the vaguely-similar-looking issues we saw earlier this week.)

Test Plan
  • Added a new email address.
  • Clicked "Done" on the last step.
  • Completed workflow instead of getting a CSRF error.

Diff Detail

Repository
rP Phabricator
Branch
csrf1
Lint
Lint Passed
Unit
Tests Passed
Build Status
Buildable 12841
Build 16363: Run Core Tests
Build 16362: arc lint + arc unit

Event Timeline

epriestley retitled this revision from to Fix a CSRF issue with adding new email addresses.
epriestley updated this object.
epriestley edited the test plan for this revision. (Show Details)
epriestley added a reviewer: chad.
tide added a reviewer: tide.
This revision is now accepted and ready to land.Jun 30 2016, 3:31 PM
This revision was automatically updated to reflect the committed changes.