From a306294cf9e4d4a4ded2c840f9a1ce8ba412b6a7 Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Tue, 30 Nov 2021 09:50:49 -0800 Subject: Block CSRF attack against admin or admindb pages. --- Mailman/Cgi/admin.py | 3 ++- Mailman/Cgi/admindb.py | 3 ++- Mailman/Cgi/edithtml.py | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) (limited to 'Mailman/Cgi') diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py index b5f14824..a25d7e74 100644 --- a/Mailman/Cgi/admin.py +++ b/Mailman/Cgi/admin.py @@ -107,7 +107,8 @@ def main(): 'legend'] params = cgidata.keys() if set(params) - set(safe_params): - csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token')) + csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'), + 'admin') else: csrf_checked = True # if password is present, void cookie to force password authentication. diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py index 45ba6492..a210efd9 100644 --- a/Mailman/Cgi/admindb.py +++ b/Mailman/Cgi/admindb.py @@ -144,7 +144,8 @@ def main(): safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details'] params = cgidata.keys() if set(params) - set(safe_params): - csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token')) + csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'), + 'admindb') else: csrf_checked = True # if password is present, void cookie to force password authentication. diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py index 1dd9e87b..170e8116 100644 --- a/Mailman/Cgi/edithtml.py +++ b/Mailman/Cgi/edithtml.py @@ -111,7 +111,8 @@ def main(): safe_params = ['VARHELP', 'adminpw', 'admlogin'] params = cgidata.keys() if set(params) - set(safe_params): - csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token')) + csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'), + 'admin') else: csrf_checked = True # if password is present, void cookie to force password authentication. -- cgit v1.2.3