If the admin selects "clone without confirmation" they in fact are vulnerable to CSRF. Since this is not the default setting, and doesn't cause data loss, this is approved as a public issue by the Drupal security team.

This issue was reported by Jonathan Hedstrom.

CommentFileSizeAuthor
#5 1217966-5.patch3.59 KBpwolanin
#3 1217966-3.patch3.74 KBpwolanin

Comments

pwolanin’s picture

pwolanin commented
Version: 6.x-1.x-dev » 7.x-1.x-dev
pwolanin’s picture

pwolanin commented

This doesn't look very easy to do - core doesn't offer much facility for appending a query string to contextual links (or tabs). Might be able to use a to_arg function and put a token in the path?

pwolanin’s picture

pwolanin commented
Status: Active » Needs review
StatusFileSize
new 1217966-3.patch3.74 KB

Kinda ugly, but here's a 1st pass.

Maybe the token should depend on the node ID too?

pwolanin’s picture

pwolanin commented

An alternative to actually changing the path for the "normal" case would be to swap out the router item depending on the setting, which means forcing a menu rebuild if the setting changes. That's maybe ok, but not so nice either.

pwolanin’s picture

pwolanin commented
StatusFileSize
new 1217966-5.patch3.59 KB

Simplified logic makes the patch much smaller.

pwolanin’s picture

pwolanin commented
Title: Harden or change the "create without confirmation" to prevent CSRF » Add to token to "create without confirmation" to prevent CSRF
Version: 7.x-1.x-dev » 6.x-1.x-dev
Status: Needs review » Patch (to be ported)

needs to be backported.

pwolanin’s picture

pwolanin commented
Issue summary: View changes

adding credit to the reporter: Jonathan Hedstrom

  • Commit 0c67cf6 on 7.x-1.x, 8.x-1.x by pwolanin: 
    Issue #1217966 by pwolanin: Add to token to "create without confirmation...