Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-21 01:46:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

core: fix csrf

Browse Source
This commit is contained in:
undefined committed 2021-05-07 08:21:16 +08:00
1 parent 92b2535b89
commit fc98c61f7b
2 files changed
+5 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/hydrooj/src/service/server.ts
+4 -4
View File
@@ -482,10 +482,6 @@ export class Handler extends HandlerCommon {
}
async init({ domainId }) {
if (this.request.headers.referer) {
const hostname = new URL(this.request.headers.referer).hostname;
if (hostname !== this.request.hostname) throw new CsrfTokenError();
}
if (!argv.benchmark) await this.limitRate('global', 10, 88);
const [absoluteDomain, inferDomain, bdoc] = await Promise.all([
domain.get(domainId),
@@ -524,6 +520,10 @@ export class Handler extends HandlerCommon {
text: global.Hydro.lib[key].text,
}));
if (!this.noCheckPermView) this.checkPerm(PERM.PERM_VIEW);
if (this.request.method === 'POST' && this.request.headers.referer) {
const hostname = new URL(this.request.headers.referer).hostname;
if (hostname !== this.request.hostname) throw new CsrfTokenError(hostname);
}
}
async finish() {