Infrastructure/opengist
0
Fork 0
mirror of https://github.com/thomiceli/opengist.git synced 2025-02-12 01:48:02 -05:00
Code Issues Activity

Remove CSRF check for Git HTTP packs (#408)

Browse source
This commit is contained in:
Thomas Miceli 2025-01-20 03:18:28 +01:00 • committed by GitHub
parent a752e0561d
commit 662f553d37
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
internal/web/context/context.go
View file

@ -28,11 +28,14 @@ type Context struct {
} }
func NewContext(c echo.Context, sessionPath string) *Context { func NewContext(c echo.Context, sessionPath string) *Context {
return &Context{ ctx := &Context{
Context: c, Context: c,
data: make(echo.Map), data: make(echo.Map),
store: NewStore(sessionPath), store: NewStore(sessionPath),
} }
ctx.SetRequest(ctx.Request().WithContext(context.WithValue(ctx.Request().Context(), DataKeyStr, ctx.data)))
return ctx
} }
func (ctx *Context) SetData(key string, value any) { func (ctx *Context) SetData(key string, value any) {

11
internal/web/server/middlewares.go
View file

@ -17,6 +17,7 @@ import (
"html/template" "html/template"
"net/http" "net/http"
"path/filepath" "path/filepath"
"regexp"
"strings" "strings"
"time" "time"
) )
@ -61,7 +62,15 @@ func (s *Server) registerMiddlewares() {
Skipper: func(ctx echo.Context) bool { Skipper: func(ctx echo.Context) bool {
/* skip CSRF for embeds */ /* skip CSRF for embeds */
gistName := ctx.Param("gistname") gistName := ctx.Param("gistname")
return filepath.Ext(gistName) == ".js"
/* skip CSRF for git clients */
matchUploadPack, _ := regexp.MatchString("(.*?)/git-upload-pack$", ctx.Request().URL.Path)
matchReceivePack, _ := regexp.MatchString("(.*?)/git-receive-pack$", ctx.Request().URL.Path)
return filepath.Ext(gistName) == ".js" || matchUploadPack || matchReceivePack
},
ErrorHandler: func(err error, c echo.Context) error {
log.Info().Err(err).Msg("CSRF error")
return err
}, },
})) }))
s.echo.Use(Middleware(csrfInit).toEcho()) s.echo.Use(Middleware(csrfInit).toEcho())