Uploaded image for project: '{RETIRED} XWiki Administration Application'
  1. {RETIRED} XWiki Administration Application
  2. XAADMINISTRATION-218

CSRF token not included in add-group-member ajax request

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 1.47
    • 1.46
    • Users, Groups, Rights
    • None
    • CSRF, bugfixingday

    Description

      A form_token parameter must be added to the url of the addNewMember
      ajax request in XWiki.XWikiGroupSheet:

      < var url = "${doc.getURL()}?xpage=adduorg&uorg=" + uorg + "&name=" + input.value;
> var url = "${doc.getURL()}?xpage=adduorg&uorg=" + uorg + "&name=" + input.value + "&form_token=$!{services.csrf.getToken()}";

      Attachments

        Activity

          People

            sdumitriu Sergiu Dumitriu
            aj Andreas Jonsson
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: