Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python script not working if owasp_csrf_protector_enable = true #709

Closed
belnet-ming opened this issue Dec 9, 2019 · 1 comment
Closed

Comments

@belnet-ming
Copy link
Contributor

Not really a bug, but a user reported that the provided Python CLI was not working.

After finding that they are trying to run it with python3, we provided them a python3 compatible (and aup_checked) version:

89c89,91
<   signed = bytes(method+'&'+base_url.replace('https://','',1).replace('http://','',1)+path+'?'+('&'.join(flatten(data))), 'ascii')
---
>   #signed = bytes(method+'&'+base_url.replace('https://','',1).replace('http://','',1)+path+'?'+('&'.join(flatten(data))), 'ascii')
>   signe = method+'&'+base_url.replace('https://','',1).replace('http://','',1)+path+'?'+('&'.join(flatdata))
>   signed = signe.encode()
96c98,100
<     signed += bytes('&'+inputcontent, 'ascii')
---
>     #signed += bytes('&'+inputcontent, 'ascii')
>     signe = '&'+inputcontent
>     signed += signe.encode()
99c103,105
<     signed += bytes('&', 'ascii')
---
>     #signed += bytes('&', 'ascii')
>     signe = '&'
>     signed += signe.encode()
164c170,171
<       'options': options
---
>       'options': options,
>       'aup_checked' : 'true'

And there is still this error:

filesender.py:78: DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated since Python 3.3,and in 3.9 it will stop working
  if isinstance(v, collections.MutableMapping):
Traceback (most recent call last):
  File "filesender.py", line 237, in <module>
    transfer = postTransfer(args.username, filesTransfer, args.recipients, subject=args.subject, message=args.message, expires=None, options=[])['created']
  File "filesender.py", line 174, in postTransfer
    {}
  File "filesender.py", line 139, in call
    raise Exception('Http error '+str(code)+' '+response.text)
Exception: Http error 400 {"message":"rest_xsrf_token_did_not_match","uid":"5dee3c50ad8ba","details":{"method":"post","endpoint":"transfer"}}

By setting:
$config['owasp_csrf_protector_enabled'] = false;
the script worked:

base_url          : https://filesender.belnet.be/rest.php
username          : xxxxxx
apikey            : xxxxxx
upload_chunk_size : 5242880 bytes
recipients        : xxxxx
files             : VBoxGuestAdditions_6.0.14.iso
postTransfer
filesender(2).py:78: DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated since Python 3.3,and in 3.9 it will stop working
  if isinstance(v, collections.MutableMapping):
putChunks: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 0-5242880 0%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 5242880-10485760 7%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 10485760-15728640 14%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 15728640-20971520 20%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 20971520-26214400 27%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 26214400-31457280 34%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 31457280-36700160 41%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 36700160-41943040 48%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 41943040-47185920 54%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 47185920-52428800 61%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 52428800-57671680 68%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 57671680-62914560 75%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 62914560-68157440 82%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 68157440-73400320 88%
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 73400320-77195264 95%
fileComplete: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso
Uploading: /home/ming/Downloads/VBoxGuestAdditions_6.0.14.iso 77195264 100%
transferComplete
Upload Complete
@WebSpider
Copy link
Collaborator

This issue was solved by PR #1233 and made it into v2.39

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants