CVE-2023-40572: XWIKI-20849: Require a CSRF token in the create action · xwiki/xwiki-platform@4b20528

Expand Up

@@ -23,6 +23,7 @@

import java.util.Locale;

import java.util.Map;

import javax.inject.Inject;

import javax.inject.Named;

import javax.inject.Provider;

import javax.inject.Singleton;

Expand Down Expand Up

@@ -96,6 +97,9 @@ public class CreateAction extends XWikiAction

*/

private static final String LOCAL_SERIALIZER_HINT = "local";

@Inject

private CSRFToken csrf;

/**

* The action to perform when creating a new page from a template.

*

Expand Down Expand Up

@@ -185,9 +189,12 @@ public String render(XWikiContext context) throws XWikiException

checkRights(newDocumentReference.getLastSpaceReference(), context);

// Check if the document to create already exists and if it respects the name strategy

// Also check the CSRF token.

XWikiDocument newDocument = context.getWiki().getDocument(newDocumentReference, context);

if (handler.isDocumentAlreadyExisting(newDocument) || handler.isDocumentPathTooLong(newDocumentReference)

|| !this.isEntityReferenceNameValid(newDocumentReference)) {

|| !this.isEntityReferenceNameValid(newDocumentReference)

|| !this.csrf.isTokenValid(context.getRequest().getParameter(“form_token”)))

{

return CREATE_TEMPLATE;

}

Expand Down Expand Up

@@ -334,8 +341,7 @@ private String getRedirectParameters(String parent, String title, String templat

redirectParams += “&title=” + Util.encodeURI(title, null);

}

// Both the save and the edit action might require a CSRF token

CSRFToken csrf = Utils.getComponent(CSRFToken.class);

redirectParams += “&form_token=” + Util.encodeURI(csrf.getToken(), null);

redirectParams += “&form_token=” + Util.encodeURI(this.csrf.getToken(), null);

return redirectParams;

}

Expand Down