amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-09-26 23:50:34 +00:00
Code Issues Projects Releases Wiki Activity

(feat) added AngularJS's XSRF support (#3246)

Browse Source
This commit is contained in:
Ludovic Marcotte
2016-04-26 11:07:22 -04:00
parent 2da7a04bac
commit 582baf2960
40 changed files with 224 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
UI/MainUI/SOGoRootPage.m
+17 -3
View File
@@ -36,6 +36,7 @@
#import <Appointments/SOGoAppointmentFolders.h>
#import <SOGo/NSString+Crypto.h>
#import <SOGo/NSString+Utilities.h>
#import <SOGo/SOGoBuild.h>
#import <SOGo/SOGoCache.h>
@@ -170,14 +171,14 @@
{
WOResponse *response;
WORequest *request;
WOCookie *authCookie;
WOCookie *authCookie, *xsrfCookie;
SOGoWebAuthenticator *auth;
SOGoAppointmentFolders *calendars;
SOGoUserDefaults *ud;
SOGoUser *loggedInUser;
NSDictionary *params;
NSString *username, *password, *language, *domain, *remoteHost;
NSArray *supportedLanguages;
NSArray *supportedLanguages, *creds;
SOGoPasswordPolicyError err;
int expire, grace;
@@ -232,6 +233,13 @@
inContext: context];
[response addCookie: authCookie];
// We prepare the XSRF protection cookie
creds = [auth parseCredentials: [authCookie value]];
xsrfCookie = [WOCookie cookieWithName: @"XSRF-TOKEN"
value: [[SOGoSession valueForSessionKey: [creds lastObject]] asSHA1String]];
[xsrfCookie setPath: [NSString stringWithFormat: @"/%@/", [[context request] applicationName]]];
[response addCookie: xsrfCookie];
supportedLanguages = [[SOGoSystemDefaults sharedSystemDefaults]
supportedLanguages];
loggedInUser = [SOGoUser userWithLogin: username];
@@ -540,8 +548,8 @@
- (WOResponse *) changePasswordAction
{
NSString *username, *domain, *password, *newPassword, *value;
WOCookie *authCookie, *xsrfCookie;
NSDictionary *message;
WOCookie *authCookie;
NSArray *creds;
SOGoUserManager *um;
SOGoPasswordPolicyError error;
@@ -592,6 +600,12 @@
andPassword: newPassword
inContext: context];
[response addCookie: authCookie];
// We update the XSRF protection cookie
creds = [auth parseCredentials: [authCookie value]];
xsrfCookie = [WOCookie cookieWithName: @"XSRF-TOKEN"
value: [[SOGoSession valueForSessionKey: [creds lastObject]] asSHA1String]];
[response addCookie: xsrfCookie];
}
else
response = [self _responseWithLDAPPolicyError: error];