Congegni
/
sintonia
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #75 - Saas relder csrf delete file

This commit is contained in:
Albert Santoni 2014-10-29 17:55:42 -04:00
parent 53dc92b204
commit fd39db2e24
2 changed files with 22 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
airtime_mvc/application/modules/rest/controllers/MediaController.php
View File

@ -304,8 +304,14 @@ class Rest_MediaController extends Zend_Rest_Controller
private function verifyAuth($checkApiKey, $checkSession)
{
// Session takes precedence over API key for now:
if ($checkSession && $this->verifySession())
{
if ($checkSession && $this->verifySession()) {
// CSRF token validation only applies to session based authorization.
if(!$this->verifyCSRFToken($this->_getParam('csrf_token'))){
$resp = $this->getResponse();
$resp->setHttpResponseCode(401);
$resp->appendBody("ERROR: Token Missmatch.");
return false;
}
return true;
}
@ -321,6 +327,17 @@ class Rest_MediaController extends Zend_Rest_Controller
return false;
}
private function verifyCSRFToken($token){
$current_namespace = new Zend_Session_Namespace('csrf_namespace');
$observed_csrf_token = $token;
$expected_csrf_token = $current_namespace->authtoken;
if($observed_csrf_token == $expected_csrf_token){
return true;
}else{
return false;
}
}
private function verifyAPIKey()
{

2
airtime_mvc/public/js/airtime/library/plupload.js
View File

@ -89,7 +89,7 @@ $(document).ready(function() {
$.ajax({
type: 'DELETE',
url: '/rest/media/' + file.id,
url: 'rest/media/' + file.id + "?csrf_token=" + $("#csrf").attr('value'),
success: function(resp) {
self.recentUploadsTable.fnDraw();
},