diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2018-04-05 00:15:22 +0200 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2018-04-05 00:15:22 +0200 |
| commit | 186e690c08a8766aecf9a0ffc60b4475e366d723 (patch) | |
| tree | 320b100a84d90c2fca0ed970d3bb20864f1eab36 /contrib | |
| parent | 697db81246bf9e3256c7217a00ee4e7757c87077 (diff) | |
luci-base: dispatcher: reject non-POST requests with any cbi.submit value
Due to the fact that luci.model.cbi reacts on any "cbi.submit" value while
the dispatcher only required POST for cbi.submit == 1, the CSRF token
protection could be bypassed.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'contrib')
0 files changed, 0 insertions, 0 deletions