Infrastructure/opengist
0
Fork 0
mirror of https://github.com/thomiceli/opengist.git synced 2025-02-12 01:48:02 -05:00
Code Issues Activity

Remove CSRF check for Git HTTP packs (#408)

Browse source
This commit is contained in:
Thomas Miceli 2025-01-20 03:18:28 +01:00 • committed by GitHub
parent a752e0561d
commit 662f553d37
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
internal/web/context/context.go
View file

@ -28,11 +28,14 @@ type Context struct {
}
func NewContext(c echo.Context, sessionPath string) *Context {
return &Context{
ctx := &Context{
Context: c,
data: make(echo.Map),
store: NewStore(sessionPath),
}
ctx.SetRequest(ctx.Request().WithContext(context.WithValue(ctx.Request().Context(), DataKeyStr, ctx.data)))
return ctx
}
func (ctx *Context) SetData(key string, value any) {

11
internal/web/server/middlewares.go
View file

@ -17,6 +17,7 @@ import (
"html/template"
"net/http"
"path/filepath"
"regexp"
"strings"
"time"
)
@ -61,7 +62,15 @@ func (s *Server) registerMiddlewares() {
Skipper: func(ctx echo.Context) bool {
/* skip CSRF for embeds */
gistName := ctx.Param("gistname")
return filepath.Ext(gistName) == ".js"
/* skip CSRF for git clients */
matchUploadPack, _ := regexp.MatchString("(.*?)/git-upload-pack$", ctx.Request().URL.Path)
matchReceivePack, _ := regexp.MatchString("(.*?)/git-receive-pack$", ctx.Request().URL.Path)
return filepath.Ext(gistName) == ".js" || matchUploadPack || matchReceivePack
},
ErrorHandler: func(err error, c echo.Context) error {
log.Info().Err(err).Msg("CSRF error")
return err
},
}))
s.echo.Use(Middleware(csrfInit).toEcho())