Skip to content

Commit 965dfb6

Browse files
DavidBlaaDavidBlaa
committed
#2177 add ValidateAntiForgeryToken for header and form as attribute, update bexis.core.ui to 0.4.49 to send token via haeder in axois, add ValidateAntiForgeryTokenOnPost to search and public search and group controller as a test
1 parent b7b0d98 commit 965dfb6

File tree

19 files changed

+114
-45
lines changed

19 files changed

+114
-45
lines changed

‎Components/App/BExIS.App.Bootstrap/Attributes/ValidateAntiForgeryTokenOnPost.cs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
using BExIS.Security.Entities.Requests;
2+
using System.Web.Helpers;
3+
using System.Web.Mvc;
4+
5+
namespace BExIS.App.Bootstrap.Attributes
6+
{
7+
public class ValidateAntiForgeryTokenOnPost: ActionFilterAttribute
8+
{
9+
public void OnAuthorization(AuthorizationContext filterContext)
10+
{
11+
var request = filterContext.HttpContext.Request;
12+
13+
if (filterContext.HttpContext.Request.HttpMethod == "POST")
14+
{
15+
var cookieToken = request.Cookies[AntiForgeryConfig.CookieName]?.Value;
16+
17+
// check for token in form data
18+
var formToken = request.Form["__RequestVerificationToken"];
19+
20+
// check header for post from javascript
21+
if (formToken==null)
22+
{
23+
formToken = request.Headers["__RequestVerificationToken"];
24+
}
25+
26+
AntiForgery.Validate(cookieToken, formToken);
27+
//AntiForgery.Validate();
28+
}
29+
}
30+
}
31+
}

‎Components/App/BExIS.App.Bootstrap/BExIS.App.Bootstrap.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@
112112
<Compile Include="Attributes\MinCapacityAttribute.cs" />
113113
<Compile Include="Attributes\NoNullOrEmptyItemsAttribute.cs" />
114114
<Compile Include="Attributes\ThrottlingFilterAttribute.cs" />
115+
<Compile Include="Attributes\ValidateAntiForgeryTokenOnPost.cs" />
115116
<Compile Include="Extensions\AuthorizationContextExtensions.cs" />
116117
<Compile Include="Helpers\BExISAuthorizeHelper.cs" />
117118
<Compile Include="Helpers\JwtHelper.cs" />

‎Console/BExIS.Web.Shell.Svelte/package-lock.json‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Console/BExIS.Web.Shell.Svelte/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
},
5353
"type": "module",
5454
"dependencies": {
55-
"@bexis2/bexis2-core-ui": "0.4.47",
55+
"@bexis2/bexis2-core-ui": "0.4.49",
5656
"@sveltejs/adapter-static": "3.0.2",
5757
"buffer": "6.0.3",
5858
"gray-matter": "4.0.3",

‎Console/BExIS.Web.Shell/Areas/DCM/BExIS.Modules.Dcm.UI.Svelte/package-lock.json‎

Lines changed: 9 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Console/BExIS.Web.Shell/Areas/DCM/BExIS.Modules.Dcm.UI.Svelte/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@
5050
},
5151
"type": "module",
5252
"dependencies": {
53-
"@bexis2/bexis2-core-ui": "0.4.47",
53+
"@bexis2/bexis2-core-ui": "0.4.49",
5454
"@bexis2/bexis2-rpm-ui": "0.2.11",
5555
"@floating-ui/dom": "1.6.8",
5656
"@fortawesome/free-solid-svg-icons": "6.6.0",

‎Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI.Svelte/package-lock.json‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI.Svelte/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@
5050
},
5151
"type": "module",
5252
"dependencies": {
53-
"@bexis2/bexis2-core-ui": "0.4.47",
53+
"@bexis2/bexis2-core-ui": "0.4.49",
5454
"@floating-ui/dom": "1.6.8",
5555
"@fortawesome/free-solid-svg-icons": "6.6.0",
5656
"@sveltejs/adapter-static": "3.0.2",

‎Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI/Controllers/PublicSearchController.cs‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
using BExIS.Ddm.Api;
1+
using BExIS.App.Bootstrap.Attributes;
2+
using BExIS.Ddm.Api;
23
using BExIS.UI.Helpers;
34
using BExIS.Utils.Models;
45
using Newtonsoft.Json;
@@ -55,7 +56,7 @@ public JsonResult Query()
5556
/// <param name="searchType"></param>
5657
/// <param name="model"></param>
5758
/// <returns></returns>
58-
[HttpPost]
59+
[HttpPost, ValidateAntiForgeryTokenOnPost]
5960
public JsonResult Query(string autoComplete, string FilterList, string searchType)
6061
{
6162
ViewBag.Title = PresentationModel.GetViewTitleForTenant("Search in Public Datasets", this.Session.GetTenant());
@@ -100,7 +101,7 @@ public JsonResult Query(string autoComplete, string FilterList, string searchTyp
100101
/// <param name="searchType"></param>
101102
/// <param name="model"></param>
102103
/// <returns></returns>
103-
[HttpPost]
104+
[HttpPost, ValidateAntiForgeryTokenOnPost]
104105
public JsonResult FilterByDropDownList(string SelectedFilter, string searchType)
105106
{
106107
ViewBag.Title = PresentationModel.GetViewTitleForTenant("Search", this.Session.GetTenant());
@@ -115,7 +116,7 @@ public JsonResult FilterByDropDownList(string SelectedFilter, string searchType)
115116
/// </summary>
116117
/// <param name="model"></param>
117118
/// <returns></returns>
118-
[HttpPost]
119+
[HttpPost, ValidateAntiForgeryTokenOnPost]
119120
public JsonResult _AutoCompleteAjaxLoading(string text)
120121
{
121122
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -131,7 +132,7 @@ public JsonResult _AutoCompleteAjaxLoading(string text)
131132
/// <param name="value">consist the searchType</param>
132133
/// <param name="model"></param>
133134
/// <returns></returns>
134-
[HttpPost]
135+
[HttpPost, ValidateAntiForgeryTokenOnPost]
135136
public void ChangeSearchValuesACBySearchType(string value)
136137
{
137138
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -151,7 +152,7 @@ public void ChangeSearchValuesACBySearchType(string value)
151152
/// <param name="IsChecked">show the status of the checkbox (true = selected/false=deselected)</param>
152153
/// <param name="model"></param>
153154
/// <returns></returns>
154-
[HttpPost]
155+
[HttpPost, ValidateAntiForgeryTokenOnPost]
155156
public JsonResult ToggleFacet(string SelectedItem, string Parent)
156157
{
157158
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -222,7 +223,7 @@ public JsonResult OnSelectTreeViewItem(string SelectedItem, string Parent)
222223
/// </summary>
223224
/// <param name="model"></param>
224225
/// <returns></returns>
225-
[HttpPost]
226+
[HttpPost, ValidateAntiForgeryTokenOnPost]
226227
public JsonResult AddFacetsToSearch()
227228
{
228229
ViewBag.Title = PresentationModel.GetViewTitleForTenant("Search", this.Session.GetTenant());
@@ -327,7 +328,7 @@ public JsonResult RemoveSearchCriteria(string value, string parent)
327328
#endregion BreadcrumbView
328329

329330
#region Datagrid
330-
[HttpPost]
331+
[HttpPost, ValidateAntiForgeryTokenOnPost]
331332
public JsonResult GetTableData()
332333
{
333334
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -348,14 +349,14 @@ public JsonResult SetResultViewVar(string key, string value)
348349
#region Properties _searchProperties
349350

350351
//+++++++++++++++++++++ Properties Sliders Action +++++++++++++++++++++++++++
351-
[HttpPost]
352+
[HttpPost, ValidateAntiForgeryTokenOnPost]
352353
public JsonResult FilterByRangeSlider(int start, int end, string parent)
353354
{
354355
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
355356
return Json(provider.WorkingSearchModel);
356357
}
357358

358-
[HttpPost]
359+
[HttpPost, ValidateAntiForgeryTokenOnPost]
359360
public JsonResult FilterBySlider(int value, string parent)
360361
{
361362
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -368,7 +369,7 @@ public JsonResult FilterBySlider(int value, string parent)
368369
}
369370

370371
//+++++++++++++++++++++Properties DropDown Action +++++++++++++++++++++++++++
371-
[HttpPost]
372+
[HttpPost, ValidateAntiForgeryTokenOnPost]
372373
public JsonResult FilterByDropDown(string value, string node)
373374
{
374375
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -381,7 +382,7 @@ public JsonResult FilterByDropDown(string value, string node)
381382
}
382383

383384
//+++++++++++++++++++++Properties RadioButton Action +++++++++++++++++++++++++++
384-
[HttpPost]
385+
[HttpPost, ValidateAntiForgeryTokenOnPost]
385386
public JsonResult FilterByRadioButton(string value, string node, bool isChecked)
386387
{
387388
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -393,7 +394,7 @@ public JsonResult FilterByRadioButton(string value, string node, bool isChecked)
393394

394395
//+++++++++++++++++++++Properties ´CheckButton Action +++++++++++++++++++++++++++
395396

396-
[HttpPost]
397+
[HttpPost, ValidateAntiForgeryTokenOnPost]
397398
public JsonResult FilterByCheckBox(string value, string node, bool isChecked)
398399
{
399400
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();

‎Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI/Controllers/SearchController.cs‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
using BExIS.Ddm.Api;
1+
using BExIS.App.Bootstrap.Attributes;
2+
using BExIS.Ddm.Api;
3+
using BExIS.Security.Entities.Requests;
24
using BExIS.UI.Helpers;
35
using BExIS.Utils.Models;
46
using BExIS.Xml.Helpers;
@@ -7,6 +9,7 @@
79
using System.Collections.Generic;
810
using System.Data;
911
using System.Linq;
12+
using System.Web.Helpers;
1013
using System.Web.Mvc;
1114
using Telerik.Web.Mvc;
1215
using Vaiona.IoC;
@@ -62,6 +65,7 @@ public JsonResult Query()
6265
/// <param name="model"></param>
6366
/// <returns></returns>
6467
[HttpPost]
68+
[ValidateAntiForgeryTokenOnPost]
6569
public JsonResult Query(string autoComplete, string FilterList, string searchType)
6670
{
6771
ViewBag.Title = PresentationModel.GetViewTitleForTenant("Search", this.Session.GetTenant());
@@ -176,6 +180,7 @@ public void ChangeSearchValuesACBySearchType(string value)
176180
/// <param name="model"></param>
177181
/// <returns></returns>
178182
[HttpPost]
183+
[ValidateAntiForgeryTokenOnPost]
179184
public JsonResult ToggleFacet(string SelectedItem, string Parent)
180185
{
181186
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -257,6 +262,7 @@ public JsonResult OnSelectTreeViewItem(string SelectedItem, string Parent)
257262
/// <param name="model"></param>
258263
/// <returns></returns>
259264
[HttpPost]
265+
[ValidateAntiForgeryTokenOnPost]
260266
public JsonResult AddFacetsToSearch()
261267
{
262268
ViewBag.Title = PresentationModel.GetViewTitleForTenant("Search", this.Session.GetTenant());
@@ -368,6 +374,7 @@ public JsonResult RemoveSearchCriteria(string value, string parent)
368374

369375
#region Datagrid
370376
[HttpPost]
377+
[ValidateAntiForgeryTokenOnPost]
371378
public JsonResult GetTableData()
372379
{
373380
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -389,6 +396,7 @@ public JsonResult SetResultViewVar(string key, string value)
389396

390397
//+++++++++++++++++++++ Properties Sliders Action +++++++++++++++++++++++++++
391398
[HttpPost]
399+
[ValidateAntiForgeryTokenOnPost]
392400
public JsonResult FilterByRangeSlider(int start, int end, string parent)
393401
{
394402
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -398,6 +406,7 @@ public JsonResult FilterByRangeSlider(int start, int end, string parent)
398406
}
399407

400408
[HttpPost]
409+
[ValidateAntiForgeryTokenOnPost]
401410
public JsonResult FilterBySlider(int value, string parent)
402411
{
403412
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -411,6 +420,7 @@ public JsonResult FilterBySlider(int value, string parent)
411420

412421
//+++++++++++++++++++++Properties DropDown Action +++++++++++++++++++++++++++
413422
[HttpPost]
423+
[ValidateAntiForgeryTokenOnPost]
414424
public JsonResult FilterByDropDown(string value, string node)
415425
{
416426
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -424,6 +434,7 @@ public JsonResult FilterByDropDown(string value, string node)
424434

425435
//+++++++++++++++++++++Properties RadioButton Action +++++++++++++++++++++++++++
426436
[HttpPost]
437+
[ValidateAntiForgeryTokenOnPost]
427438
public JsonResult FilterByRadioButton(string value, string node, bool isChecked)
428439
{
429440
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();
@@ -436,6 +447,7 @@ public JsonResult FilterByRadioButton(string value, string node, bool isChecked)
436447
//+++++++++++++++++++++Properties ´CheckButton Action +++++++++++++++++++++++++++
437448

438449
[HttpPost]
450+
[ValidateAntiForgeryTokenOnPost]
439451
public JsonResult FilterByCheckBox(string value, string node, bool isChecked)
440452
{
441453
ISearchProvider provider = IoCFactory.Container.ResolveForSession<ISearchProvider>();

0 commit comments

Comments
 (0)