These links should use tokens, I'll email why.

CommentFileSizeAuthor
biblio-publication-types-csfr-hide-show-links-1.patch3.37 KBAlan D.
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Alan D. created an issue. See original summary.

Alan D.’s picture

Alan D. CreditAttribution: Alan D. commented
Priority: Critical » Normal

Since the security issues are all public... this is a Cross-Site Request Forgery (CSRF).

You could embed these links as image src attributes, get the admin to visit the page, and iff they are logged in, each would be actioned!

Liam Morland’s picture

Liam Morland
Primary language English
Location Ontario, CA 🇨🇦
CreditAttribution: Liam Morland at University of Waterloo commented
Parent issue: » #2856491: Biblio Security Vulnerabilities

  • Liam Morland committed ee585a4 on 7.x-1.x authored by Alan D. 
    Issue #2855901 by Alan D., Liam Morland: Use security tokens in admin...
  • Liam Morland committed f2c93c7 on 7.x-1.x
    Issue #2855901 by Liam Morland: Refactor visibility link generation
Liam Morland’s picture

Liam Morland
Primary language English
Location Ontario, CA 🇨🇦
CreditAttribution: Liam Morland at University of Waterloo commented
Title: Publication type links » Use security tokens in admin links
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.