squidy/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2025-12-29 03:38:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

[WebUI] relax CSRF defense. Closes #6882.

Browse Source 
Allow HTTP request which has neither Origin nor Referer header included
This commit is contained in:
Chocobo1
2017-06-02 18:17:51 +08:00
committed by sledgehammer999
parent bf6f103142
commit 8d2fb06f65
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/webui/abstractwebapplication.cpp
View File

@@ -396,9 +396,9 @@ bool AbstractWebApplication::isCrossSiteRequest(const Http::Request &request) co
const QString refererValue = request.headers.value(Http::HEADER_REFERER);
if (originValue.isEmpty() && refererValue.isEmpty()) {
if ((request.path == QLatin1String("/")) || (request.path == QLatin1String("/favicon.ico")))
return false; // normal request
return true;
// owasp.org recommends to block this request, but doing so will inevitably lead Web API users to spoof headers
// so lets be permissive here
return false;
}
// sent with CORS requests, as well as with POST requests