github
/
halo
mirror of https://github.com/halo-dev/halo
1
0
Fork 0
Code Issues Releases Wiki Activity

Disable CSRF protection for actuator endpoints (#6830) 

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

This PR disables CSRF protection for actuator endpoints because they are not state-changing operations.

#### Which issue(s) this PR fixes:

Fixes #6827 

#### Special notes for your reviewer:

Try to restore Halo.

#### Does this PR introduce a user-facing change?

```release-note
修复恢复备份后无法自动重启的问题
```
pull/6836/head
John Niang 2024-10-12 12:15:09 +08:00 committed by GitHub
parent 0ad565f35c
commit cecbfcfa4a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
application/src/main/java/run/halo/app/security/CsrfConfigurer.java
View File

@ -18,8 +18,12 @@ class CsrfConfigurer implements SecurityConfigurer {
public void configure(ServerHttpSecurity http) { public void configure(ServerHttpSecurity http) {
var csrfMatcher = new AndServerWebExchangeMatcher( var csrfMatcher = new AndServerWebExchangeMatcher(
CsrfWebFilter.DEFAULT_CSRF_MATCHER, CsrfWebFilter.DEFAULT_CSRF_MATCHER,
new NegatedServerWebExchangeMatcher( new NegatedServerWebExchangeMatcher(pathMatchers(
pathMatchers("/api/**", "/apis/**", "/system/setup")) "/api/**",
"/apis/**",
"/actuator/**",
"/system/setup"
))
); );
http.csrf(csrfSpec -> csrfSpec http.csrf(csrfSpec -> csrfSpec
.csrfTokenRepository(new CookieServerCsrfTokenRepository()) .csrfTokenRepository(new CookieServerCsrfTokenRepository())