kallithea Changeset - ae947de541d5

Changeset - ae947de541d5

Parent rev.

Child rev.

[Not reviewed]

default

0 1 0

Mads Kiilerich - 11 years ago 2015-04-07 03:30:05
madski@unity3d.com

auth: check CSRF protection token when authenticating

Use pylons secure_form to get CSRF protection on all authenticated POSTs. This
fixes CVE-2015-0276.

GETs should not have any side effects and do thus not need CSRF protection.

Reported by Paul van Empelen.

1 file changed with 8 insertions and 0 deletions:

kallithea/lib/auth.py

0 comments (0 inline, 0 general)

kallithea/lib/auth.py

➞

Show inline comments

@@ @@ -30,24 +30,25 @@ import random @@
 import logging
 import traceback
 import hashlib
 import itertools
 import collections
 from tempfile import _RandomNameSequence
 from decorator import decorator
 from pylons import url, request
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 from webhelpers.pylonslib import secure_form
 from sqlalchemy import or_
 from sqlalchemy.orm.exc import ObjectDeletedError
 from sqlalchemy.orm import joinedload
 from kallithea import __platform__, is_windows, is_unix
 from kallithea.lib.vcs.utils.lazy import LazyProperty
 from kallithea.model import meta
 from kallithea.model.meta import Session
 from kallithea.model.user import UserModel
 from kallithea.model.db import User, Repository, Permission, \
     UserToPerm, UserGroupRepoToPerm, UserGroupToPerm, UserGroupMember, \
     RepoGroup, UserGroupRepoGroupToPerm, UserIpMap, UserGroupUserGroupToPerm, \
@@ @@ -755,24 +756,31 @@ class LoginRequired(object): @@
         if self.api_access or api_access_valid:
             log.debug('Checking API KEY access for %s' % cls)
             if _api_key and _api_key in user.api_keys:
                 api_access_valid = True
                 log.debug('API KEY ****%s is VALID' % _api_key[-4:])
             else:
                 api_access_valid = False
                 if not _api_key:
                     log.debug("API KEY *NOT* present in request")
                 else:
                     log.warning("API KEY ****%s *NOT* valid" % _api_key[-4:])
         # CSRF protection - POSTs with session auth must contain correct token
         if request.POST and user.is_authenticated and not api_access_valid:
             token = request.POST.get(secure_form.token_key)
             if not token or token != secure_form.authentication_token():
                 log.error('CSRF check failed')
                 return abort(403)
         log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))
         reason = 'RegularAuth' if user.is_authenticated else 'APIAuth'
         if ip_access_valid and (user.is_authenticated or api_access_valid):
             log.info('user %s authenticating with:%s IS authenticated on func %s '
                      % (user, reason, loc)
+            )
             return func(*fargs, **fkwargs)
         else:
             log.warning('user %s authenticating with:%s NOT authenticated on func: %s: '
                      'IP_ACCESS:%s API_ACCESS:%s'
                      % (user, reason, loc, ip_access_valid, api_access_valid)

0 comments (0 inline, 0 general)