mirrors/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2024-11-26 19:26:59 +03:00
Code Issues Projects Releases Packages Wiki Activity

[WebUI] relax CSRF defense. Closes #6882.

Browse source 
Allow HTTP request which has neither Origin nor Referer header included
This commit is contained in:
Chocobo1 2017-06-02 18:17:51 +08:00
parent b5c0d90e9c
commit cdb8f4bc61
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/webui/abstractwebapplication.cpp
View file

@ -392,9 +392,9 @@ bool AbstractWebApplication::isCrossSiteRequest(const Http::Request &request) co
const QString refererValue = request.headers.value(Http::HEADER_REFERER);
if (originValue.isEmpty() && refererValue.isEmpty()) {
if ((request.path == QLatin1String("/")) || (request.path == QLatin1String("/favicon.ico")))
return false; // normal request
return true;
// owasp.org recommends to block this request, but doing so will inevitably lead Web API users to spoof headers
// so lets be permissive here
return false;
}
// sent with CORS requests, as well as with POST requests