USEFULL/gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2025-05-24 08:22:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: few security improvements

Browse Source
This commit is contained in:
Unknwon 2017-02-11 07:12:06 -05:00
parent 23f2efa8c1
commit 0ae666f3e6
No known key found for this signature in database
GPG Key ID: 25B575AE3213B2B3
3 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
gogs.go
View File

@ -16,7 +16,7 @@ import (
"github.com/gogits/gogs/modules/setting" "github.com/gogits/gogs/modules/setting"
) )
const APP_VER = "0.9.141.0211" const APP_VER = "0.9.142.0211"
func init() { func init() {
setting.AppVer = APP_VER setting.AppVer = APP_VER

17
routers/user/auth.go
View File

@ -55,8 +55,7 @@ func AutoSignIn(ctx *context.Context) (bool, error) {
return false, nil return false, nil
} }
if val, _ := ctx.GetSuperSecureCookie( if val, ok := ctx.GetSuperSecureCookie(base.EncodeMD5(u.Rands+u.Passwd), setting.CookieRememberName); !ok || val != u.Name {
base.EncodeMD5(u.Rands+u.Passwd), setting.CookieRememberName); val != u.Name {
return false, nil return false, nil
} }
@ -67,6 +66,13 @@ func AutoSignIn(ctx *context.Context) (bool, error) {
return true, nil return true, nil
} }
// isValidRedirect returns false if the URL does not redirect to same site.
// False: //url, http://url
// True: /url
func isValidRedirect(url string) bool {
return len(url) >= 2 && url[0] == '/' && url[1] != '/'
}
func SignIn(ctx *context.Context) { func SignIn(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("sign_in") ctx.Data["Title"] = ctx.Tr("sign_in")
@ -83,10 +89,10 @@ func SignIn(ctx *context.Context) {
} else { } else {
redirectTo, _ = url.QueryUnescape(ctx.GetCookie("redirect_to")) redirectTo, _ = url.QueryUnescape(ctx.GetCookie("redirect_to"))
} }
ctx.SetCookie("redirect_to", "", -1, setting.AppSubUrl)
if isSucceed { if isSucceed {
if len(redirectTo) > 0 { if isValidRedirect(redirectTo) {
ctx.SetCookie("redirect_to", "", -1, setting.AppSubUrl)
ctx.Redirect(redirectTo) ctx.Redirect(redirectTo)
} else { } else {
ctx.Redirect(setting.AppSubUrl + "/") ctx.Redirect(setting.AppSubUrl + "/")
@ -128,8 +134,9 @@ func SignInPost(ctx *context.Context, form auth.SignInForm) {
// Clear whatever CSRF has right now, force to generate a new one // Clear whatever CSRF has right now, force to generate a new one
ctx.SetCookie(setting.CSRFCookieName, "", -1, setting.AppSubUrl) ctx.SetCookie(setting.CSRFCookieName, "", -1, setting.AppSubUrl)
if redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to")); len(redirectTo) > 0 { redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to"))
ctx.SetCookie("redirect_to", "", -1, setting.AppSubUrl) ctx.SetCookie("redirect_to", "", -1, setting.AppSubUrl)
if isValidRedirect(redirectTo) {
ctx.Redirect(redirectTo) ctx.Redirect(redirectTo)
return return
} }

2
templates/.VERSION
View File

@ -1 +1 @@
0.9.141.0211 0.9.142.0211