CodeCow/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2026-06-21 21:32:29 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

websockets: Fix race condition in CSRF token initialization.

Browse Source 
It appears that we were not always initializing the Socket object
after `setup.js` had the opportunity to set csrf_token.

This should fix #6961.
This commit is contained in:
Tim Abbott 2018-03-30 17:38:10 -07:00
parent 4ce8f2aaa2
commit 3fd8d718f4
3 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
frontend_tests/node_tests/transmit.js
View File

@ -1,5 +1,6 @@
var noop = function () {};
set_global('$', global.make_zjquery());
set_global('page_params', {
use_websockets: true,
});

14
static/js/transmit.js
View File

@ -3,11 +3,15 @@ var transmit = (function () {
var exports = {};
var socket;
if (page_params.use_websockets) {
socket = new Socket("/sockjs");
}
// For debugging. The socket will eventually move out of this file anyway.
exports._socket = socket;
$(function () {
// We initialize the socket inside a function so that this code
// runs after `csrf_token` is initialized in setup.js.
if (page_params.use_websockets) {
socket = new Socket("/sockjs");
}
// For debugging. The socket will eventually move out of this file anyway.
exports._socket = socket;
});
function send_message_socket(request, success, error) {
request.socket_user_agent = navigator.userAgent;

2
zerver/tornado/socket.py
View File

@ -121,7 +121,7 @@ class SocketConnection(sockjs.tornado.SockJSConnection):
if 'csrf_token' not in msg['request']:
# Debugging code to help with understanding #6961
logging.error("Invalid websockets auth request: %s" % (msg['request'],))
logging.error("CSRF token missing from websockets auth request: %s" % (msg['request'],))
raise JsonableError(_('CSRF token entry missing from request'))
if not _compare_salted_tokens(msg['request']['csrf_token'], self.csrf_token):
raise JsonableError(_('CSRF token does not match that in cookie'))