Security Vulnerability: CSRF in Realms Wiki (from March 2015)

scragg0x / realms-wiki

Git based wiki inspired by Gollum

http://realms.io

GNU General Public License v2.0

833 stars 91 forks source link

Closed dereks closed 6 years ago

dereks commented 7 years ago

I just found this by accident:

Realms Wiki is vulnerable to Cross-Site Request Forgery on all posts. Especially of concern are New, Edit, and Revert.

Has this security issue been fixed yet?

If not, I'm willing to fix this by implementing a "Cookie-to-Header Token" check for all pages:

Thanks!

scragg0x commented 7 years ago

This is still an issue, a PR is welcome.