Skip to content

[BC] Unified CSRF configuration #3147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
May 3, 2023
Merged

[BC] Unified CSRF configuration #3147

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
45c19a0
Unified CSRF configuration
fballiano Apr 5, 2023
4f61c2a
converted to helper method
fballiano Apr 5, 2023
b1b7a62
converted to helper method
fballiano Apr 5, 2023
387af18
Removed configuration from readme
fballiano Apr 6, 2023
6d7f369
removed translations
fballiano Apr 6, 2023
ca11e41
removed translations
fballiano Apr 6, 2023
519f031
return data type
fballiano Apr 7, 2023
11c6780
docbloc
fballiano Apr 7, 2023
c97b991
Merge branch 'next' into csrf
fballiano Apr 26, 2023
0b3da0f
Merge branch 'next' into csrf
fballiano Apr 29, 2023
1dc24bf
changed label
fballiano May 1, 2023
ff06f11
new warning message when setting is disabled
fballiano May 1, 2023
204a6f4
suggestion by @addison74
fballiano May 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ class Mage_Adminhtml_Block_Checkout_Formkey extends Mage_Adminhtml_Block_Templat
*/
public function canShow()
{
return !Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout');
return !Mage::helper('core')->isFormKeyEnabled();
}

/**
Expand Down
6 changes: 3 additions & 3 deletions app/code/core/Mage/Checkout/controllers/MultishippingController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,7 @@ public function addressesPostAction()
return;
}

if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
$this->_redirect('*/*/addresses');
return;
}
Expand Down Expand Up @@ -349,7 +349,7 @@ public function backToShippingAction()
*/
public function shippingPostAction()
{
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
$this->_redirect('*/*/shipping');
return;
}
Expand Down Expand Up @@ -462,7 +462,7 @@ public function overviewAction()
return $this;
}

if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
$this->_redirect('*/*/billing');
return;
}
Expand Down
10 changes: 5 additions & 5 deletions app/code/core/Mage/Checkout/controllers/OnepageController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,7 +355,7 @@ public function saveBillingAction()
return;
}

if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
return;
}

Expand Down Expand Up @@ -402,7 +402,7 @@ public function saveShippingAction()
return;
}

if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
return;
}

Expand Down Expand Up @@ -431,7 +431,7 @@ public function saveShippingMethodAction()
return;
}

if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
return;
}

Expand Down Expand Up @@ -471,7 +471,7 @@ public function savePaymentAction()
return;
}

if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
return;
}

Expand Down Expand Up @@ -554,7 +554,7 @@ protected function _initInvoice()
*/
public function saveOrderAction()
{
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
if (!$this->_validateFormKey()) {
$this->_redirect('*/*');
return;
}
Expand Down
18 changes: 0 additions & 18 deletions app/code/core/Mage/Checkout/etc/system.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,23 +215,5 @@
</payment_failed>
</groups>
</checkout>
<admin>
<groups>
<security>
<fields>
<validate_formkey_checkout translate="label">
<label>Enable Form Key Validation On Checkout</label>
<frontend_type>select</frontend_type>
<source_model>adminhtml/system_config_source_yesno</source_model>
<sort_order>4</sort_order>
<comment><![CDATA[<strong style="color:red">Important!</strong> Enabling this option means
that your custom templates used in checkout process contain form_key output.
Otherwise checkout may not work.]]></comment>
<show_in_default>1</show_in_default>
</validate_formkey_checkout>
</fields>
</security>
</groups>
</admin>
</sections>
</config>
8 changes: 0 additions & 8 deletions app/code/core/Mage/Checkout/sql/checkout_setup/install-1.6.0.0.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -779,12 +779,4 @@
}
}

$setup->insert(
$this->getTable('core_config_data'),
[
'path' => 'admin/security/validate_formkey_checkout',
'value' => '1'
]
);

$installer->endSetup();
6 changes: 4 additions & 2 deletions app/code/core/Mage/Core/Controller/Front/Action.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,16 +178,18 @@ protected function _validateFormKey()
*/
protected function _isFormKeyEnabled()
{
return Mage::getStoreConfigFlag(self::XML_CSRF_USE_FLAG_CONFIG_PATH);
return Mage::helper('core')->isFormKeyEnabled();
}

/**
* Check if form_key validation enabled on checkout process
*
* @deprecated
* @see _isFormKeyEnabled
* @return bool
*/
protected function isFormkeyValidationOnCheckoutEnabled()
{
return Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout');
return $this->_isFormKeyEnabled();
}
}
8 changes: 8 additions & 0 deletions app/code/core/Mage/Core/Helper/Data.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1001,4 +1001,12 @@ public function unEscapeCSVData($data)
}
return $data;
}

/**
* @return bool
*/
public function isFormKeyEnabled()
{
return Mage::getStoreConfigFlag(Mage_Core_Controller_Front_Action::XML_CSRF_USE_FLAG_CONFIG_PATH);
}
}
15 changes: 0 additions & 15 deletions app/code/core/Mage/Newsletter/controllers/SubscriberController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,6 @@
*/
class Mage_Newsletter_SubscriberController extends Mage_Core_Controller_Front_Action
{
/**
* Use CSRF validation flag from newsletter config
*/
public const XML_CSRF_USE_FLAG_CONFIG_PATH = 'newsletter/security/enable_form_key';

/**
* New subscription action
*/
Expand Down Expand Up @@ -128,14 +123,4 @@ public function unsubscribeAction()
}
$this->_redirectReferer();
}

/**
* Check if form key validation is enabled in newsletter config.
*
* @return bool
*/
protected function _isFormKeyEnabled()
{
return Mage::getStoreConfigFlag(self::XML_CSRF_USE_FLAG_CONFIG_PATH);
}
}
3 changes: 0 additions & 3 deletions app/code/core/Mage/Newsletter/etc/config.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,9 +185,6 @@
<sending>
<set_return_path>0</set_return_path>
</sending>
<security>
<enable_form_key>0</enable_form_key>
</security>
</newsletter>
</default>
<crontab>
Expand Down
19 changes: 0 additions & 19 deletions app/code/core/Mage/Newsletter/etc/system.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,25 +105,6 @@
</un_email_template>
</fields>
</subscription>
<security translate="label">
<label>Security</label>
<sort_order>1</sort_order>
<show_in_default>1</show_in_default>
<show_in_website>1</show_in_website>
<show_in_store>1</show_in_store>
<fields>
<enable_form_key translate="label comment">
<label>Enable Form Key Validation</label>
<frontend_type>select</frontend_type>
<source_model>adminhtml/system_config_source_yesno</source_model>
<sort_order>1</sort_order>
<show_in_default>1</show_in_default>
<show_in_website>1</show_in_website>
<show_in_store>1</show_in_store>
<comment><![CDATA[<strong style="color:red">Important!</strong> Enabling this option means that your custom templates used for newsletter subscription must contain <code>form_key</code> block output. Otherwise newsletter subscription will not work.]]></comment>
</enable_form_key>
</fields>
</security>
</groups>
</newsletter>
</sections>
Expand Down