[FIXED JENKINS-37149] Added CSRF protection

jenkinsci · Aug 3, 2016 · c5bec4c · c5bec4c
1 parent abae766
commit c5bec4c
Showing 1 changed file with 29 additions and 0 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/gogs/GogsWebHookCrumbExclusion.java b/src/main/java/org/jenkinsci/plugins/gogs/GogsWebHookCrumbExclusion.java
@@ -0,0 +1,29 @@
+package org.jenkinsci.plugins.gogs;
+
+import hudson.Extension;
+import hudson.security.csrf.CrumbExclusion;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+@Extension
+public class GogsWebHookCrumbExclusion extends CrumbExclusion {
+
+    @Override
+    public boolean process(HttpServletRequest req, HttpServletResponse resp, FilterChain chain)
+            throws IOException, ServletException {
+        String pathInfo = req.getPathInfo();
+        if (pathInfo != null && pathInfo.equals(getExclusionPath())) {
+            chain.doFilter(req, resp);
+            return true;
+        }
+        return false;
+    }
+
+    public String getExclusionPath() {
+        return "/" + GogsWebHook.URLNAME + "/";
+    }
+}