mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 14:08:45 -04:00
GigiandAlexandre Alapetite
a6253486c0
* update: require POST + CSRF for updater mutations; guard post-config step The self-update check/apply mutations were reachable via GET, which is never anti-CSRF validated (the token is only checked on POST), and the privileged post-configuration step (do_post_update()/PostUpdate hook, removal of the staged update file) was additionally reauth-exempt and GET-reachable (CWE-352). - checkAction and the apply branch now require POST, so the global anti-CSRF token check applies; the update page's Check/Apply controls are POST forms carrying the token. - The post_conf finalisation is bound to a one-time session marker set by the successful apply right before its internal redirect, so it only runs as that continuation, not via a direct cross-site GET (independent of reauth config). - Reauth is now required consistently, including for apply/post_conf (was exempted); the legitimate post_conf redirect still passes on the reauth done moments earlier by the apply request. Status/index endpoints remain GET and read-only. * Reduce some comments --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>