Files
@ ae947de541d5
Branch filter:
Location: kallithea/docs/changelog.rst - annotation
ae947de541d5
200 B
text/prs.fallenstein.rst
auth: check CSRF protection token when authenticating
Use pylons secure_form to get CSRF protection on all authenticated POSTs. This
fixes CVE-2015-0276.
GETs should not have any side effects and do thus not need CSRF protection.
Reported by Paul van Empelen.
Use pylons secure_form to get CSRF protection on all authenticated POSTs. This
fixes CVE-2015-0276.
GETs should not have any side effects and do thus not need CSRF protection.
Reported by Paul van Empelen.