hiro/lack
1
0
Fork 0
mirror of https://github.com/vale981/lack synced 2025-03-05 17:31:39 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'cxxxr-fix-csrf-token-check'

Browse source
This commit is contained in:
Eitaro Fukamachi 2019-03-18 16:16:03 +09:00
commit 3d21b5b622
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/middleware/csrf.lisp
View file

@ -51,9 +51,12 @@
(csrf-token (gethash *csrf-session-key* (csrf-token (gethash *csrf-session-key*
(getf env :lack.session)))) (getf env :lack.session))))
(and csrf-token (and csrf-token
(let ((recieved-csrf-token (let ((received-csrf-token
(cdr (assoc "_csrf_token" (request-body-parameters req) :test #'string=)))) (cdr (assoc "_csrf_token" (request-body-parameters req) :test #'string=))))
(string= csrf-token recieved-csrf-token))))) ;; for multipart/form-data
(when (listp received-csrf-token)
(setf received-csrf-token (first received-csrf-token)))
(equal csrf-token received-csrf-token)))))
(defun csrf-token (session) (defun csrf-token (session)
(unless (gethash *csrf-session-key* session) (unless (gethash *csrf-session-key* session)