Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

plone4.csrffixes security HotFix issue #52

Closed
dpc22 opened this issue Oct 9, 2015 · 9 comments
Closed

plone4.csrffixes security HotFix issue #52

dpc22 opened this issue Oct 9, 2015 · 9 comments

Comments

@dpc22
Copy link

dpc22 commented Oct 9, 2015

Good afternoon,

A couple of days back the following security HotFix was released to fix CSRF problems in Plone.

https://plone.org/products/plone/security/advisories/security-vulnerability-20151006-csrf

It appears that this HotFix interferes with collective.quickupload. While file uploads complete the quickupload dialogue box always reports "Failed".

I am able to reproduce this problem on a vanilla Plone 4.3.7 site with:

 eggs=
  plone4.csrffixes==1.0.5
  collective.quickupload==1.8.0

 [versions]
 plone.protect = 3.0.14
 plone.keyring = 3.0.1
 plone.locking = 2.0.8
 cssselect = 0.9.1

Is a workaround or fix possible? Thanks.
@dpc22 dpc22 changed the title plone4.csrffixes security HotFix plone4.csrffixes security HotFix issue Oct 9, 2015
@frisi
Copy link
Member

frisi commented Oct 14, 2015

plone.protect or plone4.csrffixes is wrapping the response of the @@quick_upload_file POST request.

instead of just the plain json it returns some html.

w/o csrf protection:

{"title": "some file", "uid": "a768d231a76b4369bbc800f8834c2313", "success": true, "name": "some-file.jpg"}

w csrf protection

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html><body>
<p>{"title": "some file", "uid": "a768d231a76b4369bbc800f8834c2313", "success": true, "name": "some-file.jpg"}</p>
<script src="http://intranet.smartline.aero/++resource++protect.js" type="text/javascript" id="protect-script" data-token="a66d49fd833c9927a40c082896d2ae45557e59d2" data-site-url="http://intranet.smartline.aero"></script></body></html>

@davisagli
Copy link
Member

Make sure that that response has its Content-Type header explicitly set to application/json

@reinhardt
Copy link
Contributor

It happens with plone.protect 3.0.11 which is required for plone4.csrffixes.

Setting the content type to json properly causes a different failure in IE <= 9, but I'd say it's still better than what we have now.

See pull request #53

@alainschumi
Copy link

Hi all,

Im experieincing the same issues, I'm using the following config:

Plone version 4.3.2

eggs
collective.quickupload == 1.8.0
plone4.csrffixes==1.0.6

Version
plone.protect = 3.0.14
plone.keyring = 3.0.1
plone.locking = 2.0.8

I already tried the fix changing text/html to application/json for quick_upload.py
this works for me too.

@vito80ba
Copy link

vito80ba commented Nov 2, 2015

Hi all,
I'm also experimenting this messages in the portlet.
Plone 4.2
Collective.quickupload 1.8

Vito

@frisi
Copy link
Member

frisi commented Nov 2, 2015

@vito80ba and @alainschumi a new release is on the way - see #53
you can use the content-type-json branch to fix the problem (for IE9 you'll still see an error - see #53 (comment))

@vito80ba
Copy link

vito80ba commented Nov 4, 2015

thank's @frisi

mauritsvanrees added a commit that referenced this issue Nov 5, 2015
@mauritsvanrees
Added plone4.csrffixes to test buildout.
a2e1828 
Issue #52
@mauritsvanrees mauritsvanrees mentioned this issue Nov 5, 2015
Merged
mauritsvanrees added a commit that referenced this issue Nov 5, 2015
@mauritsvanrees
Added plone4.csrffixes to test buildout.
8df440c 
Issue #52
@puittenbroek
Copy link

1fefc10 Fixes this issue IIRC, see also #53

@frisi
Copy link
Member

frisi commented Nov 11, 2015

release 1.8.1 should work on sites with plonehotfix20150910 installed.
on IE9 you'll still get a "failed" message for uploads (that acutally worked) - see #53 (comment)

@frisi frisi closed this as completed Nov 11, 2015
@frisi frisi mentioned this issue Nov 11, 2015
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@davisagli @reinhardt @frisi @vito80ba @puittenbroek @dpc22 @alainschumi