L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-50784 ajax: Require a sesskey for all ajax requests.

Browse Source 
This needs to be done before we can expose any webservices that
change state, or return private info to ajax (to prevent CSRF).

Currently there are no webservices exposed to ajax that meet these
criteria - so this issue is to prevent future security issues.
This commit is contained in:
Damyon Wiese
2015-07-13 16:49:04 +02:00
committed by Eloy Lafuente (stronk7)
parent 2f238bcf59
commit 60b6746994
3 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/ajax/service.php
+1
View File
@@ -33,6 +33,7 @@ require_once(dirname(__FILE__) . '/../../config.php');
require_once($CFG->libdir . '/externallib.php');
require_login(null, true, null, true, true);
require_sesskey();
$rawjson = file_get_contents('php://input');
lib/amd/build/ajax.min.js
Vendored
+1 -1
View File
@@ -1 +1 @@
define(["jquery","core/config"],function(a,b){var c=function(a){var b,c,d=this,e=null,f=0;for(f=0;f<d.length;f++){if(b=d[f],c=a[f],"undefined"==typeof c){e=new Error("missing response");break}if(c.error!==!1){e=c.exception;break}b.deferred.resolve(c.data)}if(null!==e)for(;f<d.length;f++)b=d[f],b.deferred.reject(e)},d=function(a,b){var c=this,d=0;for(d=0;d<c.length;d++){var e=c[d];"undefined"!=typeof e.fail&&e.deferred.reject(b)}};return{call:function(e,f){var g,h=[],i=[];for("undefined"==typeof f&&(f=!0),g=0;g<e.length;g++){var j=e[g];h.push({index:g,methodname:j.methodname,args:j.args}),j.deferred=a.Deferred(),i.push(j.deferred.promise()),"undefined"!=typeof j.done&&j.deferred.done(j.done),"undefined"!=typeof j.fail&&j.deferred.fail(j.fail),j.index=g}h=JSON.stringify(h);var k={type:"POST",data:h,context:e,dataType:"json",processData:!1,async:f};return f?a.ajax(b.wwwroot+"/lib/ajax/service.php",k).done(c).fail(d):(k.success=c,k.error=d,a.ajax(b.wwwroot+"/lib/ajax/service.php",k)),i}}});
define(["jquery","core/config"],function(a,b){var c=function(a){var b,c,d=this,e=null,f=0;for(f=0;f<d.length;f++){if(b=d[f],c=a[f],"undefined"==typeof c){e=new Error("missing response");break}if(c.error!==!1){e=c.exception;break}b.deferred.resolve(c.data)}if(null!==e)for(;f<d.length;f++)b=d[f],b.deferred.reject(e)},d=function(a,b){var c=this,d=0;for(d=0;d<c.length;d++){var e=c[d];"undefined"!=typeof e.fail&&e.deferred.reject(b)}};return{call:function(e,f){var g,h=[],i=[];for("undefined"==typeof f&&(f=!0),g=0;g<e.length;g++){var j=e[g];h.push({index:g,methodname:j.methodname,args:j.args}),j.deferred=a.Deferred(),i.push(j.deferred.promise()),"undefined"!=typeof j.done&&j.deferred.done(j.done),"undefined"!=typeof j.fail&&j.deferred.fail(j.fail),j.index=g}h=JSON.stringify(h);var k={type:"POST",data:h,context:e,dataType:"json",processData:!1,async:f};return f?a.ajax(b.wwwroot+"/lib/ajax/service.php?sesskey="+b.sesskey,k).done(c).fail(d):(k.success=c,k.error=d,a.ajax(b.wwwroot+"/lib/ajax/service.php?sesskey="+b.sesskey,k)),i}}});
lib/amd/src/ajax.js
+2 -2
View File
@@ -146,13 +146,13 @@ define(['jquery', 'core/config'], function($, config) {
// Jquery deprecated done and fail with async=false so we need to do this 2 ways.
if (async) {
$.ajax(config.wwwroot + '/lib/ajax/service.php', settings)
$.ajax(config.wwwroot + '/lib/ajax/service.php?sesskey=' + config.sesskey, settings)
.done(requestSuccess)
.fail(requestFail);
} else {
settings.success = requestSuccess;
settings.error = requestFail;
$.ajax(config.wwwroot + '/lib/ajax/service.php', settings);
$.ajax(config.wwwroot + '/lib/ajax/service.php?sesskey=' + config.sesskey, settings);
}
return promises;