MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [user:resetauthkey] Method can only be accessed via POST request 

- As reported by an external pentest company on behalf of the Centre for Cyber security Belgium (CCB)
pull/5687/head
mokaddem 2020-03-06 15:58:08 +01:00
parent 43a0757fb3
commit de80d340cf
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/Controller/UsersController.php
View File

@ -1235,6 +1235,9 @@ class UsersController extends AppController
if (!$this->_isAdmin() && Configure::read('MISP.disableUserSelfManagement')) {
throw new MethodNotAllowedException('User self-management has been disabled on this instance.');
}
if (!$this->request->is('post') || !$this->request->is('put')) {
throw new MethodNotAllowedException(__('This functionality is only accessible via POST requests.'));
}
if ($id == 'me') {
$id = $this->Auth->user('id');
}

2
app/View/Users/admin_view.ctp
View File

@ -34,7 +34,7 @@ $buttonModifyStatus = $mayModify ? 'button_on':'button_off';
h($user['User']['authkey']),
sprintf(
' (%s)',
$this->Html->link(__('reset'), array('controller' => 'users', 'action' => 'resetauthkey', $user['User']['id']))
$this->Form->postLink(__('reset'), array('action' => 'resetauthkey', $user['User']['id']))
)
);
$table_data[] = array(

3
app/View/Users/view.ctp
View File

@ -17,7 +17,8 @@
(Configure::read('MISP.disableUserSelfManagement') && !$isAdmin) ? '' :
sprintf(
' (%s)',
$this->Html->link(__('reset'), array('controller' => 'users', 'action' => 'resetauthkey', $user['User']['id']))
$this->Form->postLink(__('reset'), array('action' => 'resetauthkey', $user['User']['id']))
)
);
}