search

Alanaktion / phproject

A high performance full-featured project management system
https://www.phproject.org
GNU General Public License v3.0
389 stars 106 forks source link

Bug found on issues : XSRF token reading #405

Closed bestkiller92 closed 2 years ago

bestkiller92 commented 2 years ago

phproject/app/controller/issues.php public function reopen($f3, $params) { $this->validateCsrf(); >> issue is comming from this line :

phproject/app/helper/security.php --> $cookieToken = $f3->get('COOKIE.XSRF-TOKEN'); $requestToken = $f3->get('POST.csrf-token');

When clicking on "reopen" there is no "POST" data, therefore the error 400 is triggered I didn't find any solution for now. Workaround : comment the $this->validateCsrf(); line

Alanaktion commented 2 years ago

This is fixed in v1.7.12