[PR #5250] [MERGED] Fix #5226 by adding CSRF checking to api reqToken and add CSRF to the POST header for deadline #17726

New Issue

GiteaMirror · 2025-11-02T15:19:54-06:00

GiteaMirror commented

2025-11-02 15:19:54 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/5250
Author: @zeripath
Created: 11/1/2018
Status: ✅ Merged
Merged: 11/4/2018
Merged by: @techknowlogick

Base: master ← Head: issue-5249

📝 Commits (3)

6373b65 Add CSRF checking to reqToken and place CSRF in the post for deadline creation
e565abd /api/v1/admin/users routes should have reqToken middleware
5c906d0 Merge branch 'master' into issue-5249

📊 Changes

5 files changed (+32 additions, -10 deletions)

View changed files

📝 integrations/api_admin_test.go (+5 -5)
📝 integrations/git_test.go (+2 -1)
📝 modules/context/api.go (+13 -0)
📝 public/js/index.js (+4 -0)
📝 routers/api/v1/api.go (+8 -4)

📄 Description

#4840 prevents CSRF attacks by preventing POSTs to API addresses without being logged in by Token or with BASIC auth. It did not add capability for providing a CSRF token.

This PR adds CSRF token checking in to the reqToken function within routers/api/v1/api.go and then adjusts the way deadlines are POSTed to pass in the CSRF token in as a header.

Fixes #5226, #5249

@beeonthego as far as I understand this would still prevent the CSRF attacks. Is this correct?

Edit: make clear #4840 was preventing CSRF attacks not XSS

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/5250 **Author:** [@zeripath](https://github.com/zeripath) **Created:** 11/1/2018 **Status:** ✅ Merged **Merged:** 11/4/2018 **Merged by:** [@techknowlogick](https://github.com/techknowlogick) **Base:** `master` ← **Head:** `issue-5249` --- ### 📝 Commits (3) - [`6373b65`](https://github.com/go-gitea/gitea/commit/6373b6515c1113ce180de1d1ca332ae6d5edccb2) Add CSRF checking to reqToken and place CSRF in the post for deadline creation - [`e565abd`](https://github.com/go-gitea/gitea/commit/e565abd7e4cbcdce91ab593906c56614f61072b8) /api/v1/admin/users routes should have reqToken middleware - [`5c906d0`](https://github.com/go-gitea/gitea/commit/5c906d0de4624548d459fb261e52dede00511b8e) Merge branch 'master' into issue-5249 ### 📊 Changes **5 files changed** (+32 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `integrations/api_admin_test.go` (+5 -5) 📝 `integrations/git_test.go` (+2 -1) 📝 `modules/context/api.go` (+13 -0) 📝 `public/js/index.js` (+4 -0) 📝 `routers/api/v1/api.go` (+8 -4) </details> ### 📄 Description #4840 prevents CSRF attacks by preventing POSTs to API addresses without being logged in by Token or with BASIC auth. It did not add capability for providing a CSRF token. This PR adds CSRF token checking in to the reqToken function within routers/api/v1/api.go and then adjusts the way deadlines are POSTed to pass in the CSRF token in as a header. Fixes #5226, #5249 @beeonthego as far as I understand this would still prevent the CSRF attacks. Is this correct? Edit: make clear #4840 was preventing CSRF attacks not XSS --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 15:19:54 -06:00

GiteaMirror closed this issue

2025-11-02 15:20:09 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17726