Joomla! Issue Tracker | Joomla! CMS #20786 - [4.0] Check session token in header

Fixed in Code Base
2 Jul 2018
Medium
Build: 4.0-dev
# 20786
Diff
brianteeman:session

Pending

User tests: Successful: Unsuccessful:

brianteeman
17 Jun 2018

No idea what this is or how to check it

It was reported as missing by @schnuti in #20642

@mbabker said it was

Probably lost in a merge conflict, not intentionally removed.

So this PR puts it back and someone clever than me can work out if it should be there or not

ede0ada 17 Jun 2018

[4.0] Check session token in header

brianteeman - open - 17 Jun 2018

brianteeman - change - 17 Jun 2018

Status

New

⇒

Pending

joomla-cms-bot - change - 17 Jun 2018

Category

⇒

Libraries

schnuti - comment - 18 Jun 2018

Thanks!
Test.

Any save of data (form post) works as before.
Ajax calls using the "magic" in JS Joomla.request (XMLHttpRequest in core.js). i.e. sets a token in header data.
2.a Before - fails with a "magic" message "Invalid token"
2.b After - it works and data gets saved.

I do not know of any core functionality using this "magic". I do and e.g. image save in the new Media Manager could remove the token from the JSON data sent. A (very) tiny bit of security I believe.

wilsonge - change - 2 Jul 2018

Status	Pending	⇒	Fixed in Code Base
Closed_Date	0000-00-00 00:00:00	⇒	2018-07-02 00:11:14
Closed_By		⇒	wilsonge
Labels	Added: ?

wilsonge - close - 2 Jul 2018

wilsonge - merge - 2 Jul 2018

wilsonge - comment - 2 Jul 2018

Thanks!

Add a Comment

Older
Newer

Joomla! Issue Tracker - CMS

[#20786] - [4.0] Check session token in header

Add a Comment