Bug #25859: CSRF protection does not work for methods that contain upper case characters - TYPO3.Flow - TYPO3 Forge

TYPO3 Flow Base Distribution TYPO3.Eel TYPO3.Flow TYPO3.Fluid TYPO3.Kickstart TYPO3.Welcome Packages Applications

Bug #25859

CSRF protection does not work for methods that contain upper case characters

Added by Bastian Waidelich over 4 years ago. Updated over 4 years ago.

Status:

Resolved

Start date:

2011-04-08

Priority:

Must have

Due date:

Assigned To:

Andreas Förthner

% Done:

100%

Category:

Security

Target version:

PHP Version:

Complexity:

Has patch:

Affected Flow version:

Description

I'm trying to protect all methods of certain controllers with following policy rule:

resources:
  methods:
    F3_BccVoting_RestrictedControllers: 'class(F3\BccVoting\Controller\(Circular|Elector|Electorate)Controller)'

For some reason the FLOW3-CSRF-TOKEN is not attached to links pointing to F3\BccVoting\Controller\Elector::deleteAll(). When clicking the link, the "You are not allowed to perform this action." exception though.

The problem is probably, that the policy service does not detect the method in the CsrfProtectionAspect because it is lowercased somewhere.

Associated revisions

Revision 797fcc64
Added by Bastian Waidelich over 4 years ago

[+BUGFIX] Fix CSRF protection for camelCased actions

The FLOW3-CSRF-TOKEN is not attached to links pointing to
actions that contain upper case letters.
The solution is to store and compare all resources lowercased.

Change-Id: Ibae8ad81a7839c983b64bad86a8631c0176c59b1
Fixes: #25859