CSRF in CodeReview ApiRevisionUpdate
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	tstarling
	Dec 8 2011, 5:30 AM

Description

The ApiRevisionUpdate module in CodeReview does not have any CSRF protection. The code says:

/**

Variation of CodeRevisionCommiter for use in the API. Removes the post and token checking from validPost
API can/will do the POST checking (and token?) */

No, it does not do token checking. ApiBase::needsToken() and ApiBase::getTokenSalt() must be overridden, which they aren't.

Version: unspecified
Severity: normal

• bzimport raised the priority of this task from to Medium.Nov 22 2014, 12:05 AM

• bzimport set Reference to bz32870.

• bzimport added a subscriber: Unknown Object (MLST).

Adding developer to CC list.

Note that the client code from r95435 will need to be updated, adding Hashar to the CC list for that.

Appears to be reverted

r95435 was reverted, but the original code Tim mentioned the issue with is still there

r110573