Uh oh!
There was an error while loading. Please reload this page.
fix: csrf check failed on public share with password - #44369
Conversation
| document.addEventListener('DOMContentLoaded', function() { | ||
| var form = document.getElementById('password-input-form'); | ||
| if (form) { | ||
| form.addEventListener('submit', async function(event) { | ||
| event.preventDefault(); | ||
| var requestToken = document.getElementById('requesttoken'); | ||
| if (requestToken) { | ||
| requestToken.value = await OC.fetchRequestToken(); | ||
| } | ||
| form.submit(); | ||
| }); | ||
| } | ||
| }); |
There was a problem hiding this comment.
would it be possible to move this into a "modern" js module that goes through webpack? then you can import @nextcloud/router directly and we avoid adding a new property to the dated OC global
| if (requestToken) { | ||
| const url = generateUrl('/csrftoken') | ||
| const resp = await Axios.get(url) | ||
| requestToken.value = resp.data.token | ||
| } |
There was a problem hiding this comment.
Could use grab the currently known CSRF token from @nextcloud/auth to avoid the additional request?
There was a problem hiding this comment.
This PR is for solving issue that the currently known CSRF token might not be the latest.
There was a problem hiding this comment.
There is an existing CSRF token update mechanism that pulls a fresh token every 30 seconds. Is that not sufficient?
There was a problem hiding this comment.
I think it is not sufficient. User might submit form during the gap time and see the CSRF failed error randomly.
emoral435
left a comment
There was a problem hiding this comment.
This looks like a valid solution to me - however, haven't tested it fully
Signed-off-by: Luka Trovic <luka@nextcloud.com>
Signed-off-by: Luka Trovic <luka@nextcloud.com>
Signed-off-by: Luka Trovic <luka@nextcloud.com>
6d5b7ea to
a42c68dCompareluka-nextcloud
commented
Jun 19, 2024
@juliushaertl@ChristophWurst@Altahrim This PR was missed from the release. |
luka-nextcloud
commented
Jun 21, 2024
/backport to stable29 |
Summary
"CSRF check failed" on public share with password
TODO
Checklist