tyler
/
proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

src/server/rest.rs: generate csrf token if we have a valid ticket 

This is important if the user reloads the browser page.
This commit is contained in:
Dietmar Maurer 2019-04-01 07:52:30 +02:00
parent 11861a482d
commit 7d4ef127cb
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/server/rest.rs
View File

@ -589,11 +589,18 @@ pub fn handle_request(api: Arc<ApiConfig>, req: Request<Body>) -> BoxFut {
} else { } else {
// not Auth required for accessing files! // not Auth required for accessing files!
if method != hyper::Method::GET {
return Box::new(future::err(http_err!(BAD_REQUEST, format!("Unsupported method"))));
}
if comp_len == 0 { if comp_len == 0 {
let (ticket, token) = extract_auth_data(&parts.headers); let (ticket, token) = extract_auth_data(&parts.headers);
if ticket != None { if ticket != None {
match check_auth(&method, &ticket, &token) { match check_auth(&method, &ticket, &token) {
Ok(username) => return Box::new(future::ok(get_index(Some(username), token))), Ok(username) => {
let new_token = assemble_csrf_prevention_token(csrf_secret(), &username);
return Box::new(future::ok(get_index(Some(username), Some(new_token))));
}
_ => return delayed_response(get_index(None, None), delay_unauth_time), _ => return delayed_response(get_index(None, None), delay_unauth_time),
} }
} else { } else {