Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

core: handle invalid referer url

Browse Source
This commit is contained in:
undefined committed 2023-11-10 21:50:24 +08:00
1 parent f305cbfc60
commit 16992e057d
1 file changed
+4
Download Patch File Download Diff File Expand all files Collapse all files
packages/hydrooj/src/service/server.ts
+4
View File
@@ -189,8 +189,12 @@ export class Handler extends HandlerCommon {
async init() { async init() {
if (this.request.method === 'post' && this.request.headers.referer && !this.context.cors && !this.allowCors) { if (this.request.method === 'post' && this.request.headers.referer && !this.context.cors && !this.allowCors) {
try {
const host = new URL(this.request.headers.referer).host; const host = new URL(this.request.headers.referer).host;
if (host !== this.request.host) this.context.pendingError = new CsrfTokenError(host); if (host !== this.request.host) this.context.pendingError = new CsrfTokenError(host);
} catch (e) {
this.context.pendingError = new CsrfTokenError();
}
} }
if (!argv.options.benchmark) await this.limitRate('global', 5, 100); if (!argv.options.benchmark) await this.limitRate('global', 5, 100);
if (!this.noCheckPermView && !this.user.hasPriv(PRIV.PRIV_VIEW_ALL_DOMAIN)) this.checkPerm(PERM.PERM_VIEW); if (!this.noCheckPermView && !this.user.hasPriv(PRIV.PRIV_VIEW_ALL_DOMAIN)) this.checkPerm(PERM.PERM_VIEW);