Feeling Lucky
?
NPM Resource Changed
?
[#36518] - [4.1] Protect Manual/Test Runs of Tasks against CSRF
- Fixed in Code Base
- 14 Jan 2022
- Medium
- Build: 4.1-dev
- # 36518
- Diff
- ditsuke:secure-run-csrf
User tests: Successful: Unsuccessful:
Pull Request for Issue #36454.
Summary of Changes
Adds CSRF protection for task "test" trigger endpoint. Token is injected in the list template.
Testing Instructions
- Create Scheduled Task, note ID.
- Goto
http://example.com/administrator/index.php?option=com_ajax&format=json&plugin=RunSchedulerTest&group=system&id={TaskID}in another tab.
Actual result BEFORE applying this Pull Request
Task is executed.
Expected result AFTER applying this Pull Request
Task is not executed since request lacks token.
Documentation Changes Required
-
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration JavaScript Repository NPM Change Front End Plugins |
PhilETaylor
- comment
- 1 Jan 2022
/********/src/build/media_source/com_scheduler/js/admin-view-run-test-task.es6.js
15s
8 21:176 error Strings must use singlequote quotes
| Labels |
Added:
NPM Resource Changed
?
|
||
ditsuke
- comment
- 1 Jan 2022
/********/src/build/media_source/com_scheduler/js/admin-view-run-test-task.es6.js 15s 8 21:176 error Strings must use singlequote quotes
@PhilETaylor fixed
fancyFranci
- comment
- 8 Jan 2022
I have tested this item
With the patch the task does not run on GET request. The "Last Run Date" confirms that.
{
"success": true,
"message": null,
"messages": null,
"data": []
}
```<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/36518">issues.joomla.org/tracker/joomla-cms/36518</a>.</sub>
fancyFranci
- comment
- 8 Jan 2022
I have tested this item
With the patch the task does not run on GET request. The "Last Run Date" confirms that.
{
"success": true,
"message": null,
"messages": null,
"data": []
}
```<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/36518">issues.joomla.org/tracker/joomla-cms/36518</a>.</sub>
jwaisner
- comment
- 11 Jan 2022
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36518.
| Status | Pending | ⇒ | Ready to Commit |
jwaisner
- comment
- 11 Jan 2022
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/36518.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-01-14 20:42:27 |
| Closed_By | ⇒ | bembelimen | |
| Labels |
Added:
?
|
||
bembelimen
- comment
- 14 Jan 2022
Thx
@PhilETaylor please test and review.