adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fixes #3887 CSRF reusable token expires

Browse source
This commit is contained in:
Schlaefer 2014-07-06 10:39:00 +02:00
parent 396725dc8c
commit 9fa7afa354
2 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/Cake/Controller/Component/SecurityComponent.php
View file

@ -554,7 +554,9 @@ class SecurityComponent extends Component {
} }
if (!$this->csrfUseOnce) { if (!$this->csrfUseOnce) {
$csrfTokens = array_keys($token['csrfTokens']); $csrfTokens = array_keys($token['csrfTokens']);
$token['key'] = $csrfTokens[0]; $authKey = $csrfTokens[0];
$token['key'] = $authKey;
$token['csrfTokens'][$authKey] = strtotime($this->csrfExpires);
} }
$this->Session->write('_Token', $token); $this->Session->write('_Token', $token);
$request->params['_Token'] = array( $request->params['_Token'] = array(

18
lib/Cake/Test/Case/Controller/Component/SecurityComponentTest.php
View file

@ -1250,6 +1250,24 @@ class SecurityComponentTest extends CakeTestCase {
$this->assertFalse(isset($token['csrfTokens']['nonce1']), 'Token was not consumed'); $this->assertFalse(isset($token['csrfTokens']['nonce1']), 'Token was not consumed');
} }
/**
* tests that reusable CSRF-token expiry is renewed
*/
public function testCsrfReusableTokenRenewal() {
$this->Security->validatePost = false;
$this->Security->csrfCheck = true;
$this->Security->csrfUseOnce = false;
$csrfExpires = '+10 minutes';
$this->Security->csrfExpires = $csrfExpires;
$this->Security->Session->write('_Token.csrfTokens', array('token' => strtotime('+1 minutes')));
$this->Security->startup($this->Controller);
$tokens = $this->Security->Session->read('_Token.csrfTokens');
$diff = strtotime($csrfExpires) - $tokens['token'];
$this->assertTrue($diff === 0 || $diff === 1, 'Token expiry was not renewed');
}
/** /**
* test that expired values in the csrfTokens are cleaned up. * test that expired values in the csrfTokens are cleaned up.
* *