Browse Source

Make it an option for post uploads

pull/73/head v0.9.1
andreimarcu 9 years ago
parent
commit
3c659601e2
  1. 4
      csrf.go
  2. 4
      upload.go

4
csrf.go

@ -8,7 +8,7 @@ import (
// Do a strict referrer check, matching against both the Origin header (if
// present) and the Referrer header. If a list of headers is specified, then
// Referrer checking will be skipped if any of those headers are present.
func strictReferrerCheck(r *http.Request, prefix string, whitelistHeaders []string) bool {
func strictReferrerCheck(r *http.Request, prefix string, whitelistHeaders []string, allowBlank bool) bool {
p, _ := url.Parse(prefix)
// if there's an Origin header, check it and skip other checks
@ -25,7 +25,7 @@ func strictReferrerCheck(r *http.Request, prefix string, whitelistHeaders []stri
referrer := r.Header.Get("Referer")
if referrer == "" {
if allowBlank && referrer == "" {
return true
}

4
upload.go

@ -46,7 +46,7 @@ type Upload struct {
}
func uploadPostHandler(c web.C, w http.ResponseWriter, r *http.Request) {
if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize", "X-Requested-With"}) {
if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize", "X-Requested-With"}, false) {
badRequestHandler(c, w, r)
return
}
@ -146,7 +146,7 @@ func uploadRemote(c web.C, w http.ResponseWriter, r *http.Request) {
}
} else {
// strict referrer checking is mandatory without remote auth keys
if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize", "X-Requested-With"}) {
if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize", "X-Requested-With"}, true) {
badRequestHandler(c, w, r)
return
}

Loading…
Cancel
Save