Support CSRF for logged-out users
f9ac534f255d
Actions

Authored by epriestley <git@epriestley.com> on Jan 23 2014, 23:03.

Description

Support CSRF for logged-out users

Summary: Fixes T4339. If you're anonymous, we use a digest of your session key to generate a CSRF token. Otherwise, everything works normally.

Test Plan: Logged out, logged in, tweaked CSRF in forms -- I'll add some inlines.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4339

Differential Revision: https://secure.phabricator.com/D8046

Details

Committed

epriestley <git@epriestley.com>

Jan 23 2014, 23:03

Pushed

aubort

Jan 31 2017, 17:16

Parents

rPH24544b1a2f24: Straighten out absolute/relative URIs in login providers

Branches

Unknown

Tags

Unknown

[HTTP/500] Internal Server Error FilesystemException: Failed to create a temporary directory: the disk is full.[HTTP/500] Internal Server Error FilesystemException: Failed to create a temporary directory: the disk is full.

Event Timeline

epriestley <git@epriestley.com> committed rPHf9ac534f255d: Support CSRF for logged-out users (authored by epriestley <git@epriestley.com>).Jan 23 2014, 23:03

Changes (5)

				Path
	M			src/aphront/AphrontRequest.php
	M			src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	M			src/applications/base/controller/PhabricatorController.php
	M			src/applications/people/storage/PhabricatorUser.php
	M			src/view/page/PhabricatorStandardPageView.php