tqt/Ghost
2
1
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2023-12-13 21:00:40 +01:00
Code Issues 1 Releases Wiki Activity

Included expected and actual origin in csrf error (#9974)

Browse source 
refs #9865
refs #9972

The previous error message did not have enough information for a user to
self diagnose issues on their blog.
This commit is contained in:
Fabien O'Carroll 2018-10-10 14:36:45 +07:00 committed by GitHub
parent 150c0d4de7
commit f9c8f2d0da
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
core/server/services/auth/session/middleware.js
View file

@ -104,9 +104,13 @@ const cookieCsrfProtection = (req, res, next) => {
return next();
}
if (req.session.origin !== getOrigin(req)) {
const origin = getOrigin(req);
if (req.session.origin !== origin) {
return next(new common.errors.BadRequestError({
message: common.i18n.t('errors.middleware.auth.mismatchedOrigin')
message: common.i18n.t('errors.middleware.auth.mismatchedOrigin', {
expected: req.session.origin,
actual: origin
})
}));
}

4
core/server/translations/en.json
View file

@ -73,8 +73,8 @@
"clientCredentialsNotProvided": "Client credentials were not provided",
"clientCredentialsNotValid": "Client credentials were not valid",
"forInformationRead": "For information on how to fix this, please read {url}.",
"unknownOrigin": "Could not determine origin of request. Please ensure an Origin or Referrer header is present",
"mismatchedOrigin": "Request made from incorrect origin.",
"unknownOrigin": "Could not determine origin of request. Please ensure an Origin or Referrer header is present.",
"mismatchedOrigin": "Request made from incorrect origin. Expected '{expected}' received '{actual}'.",
"missingUserIDForSession": "Cannot create session without user id.",
"accessDenied": "Access denied.",
"pleaseSignIn": "Please Sign In"