[java-identity-provider] branch master updated: IDP-1625 - CSRF token missing in Duo cancel request hyperlink

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2b57135f3c6574c737912947f2ef3e09600148bf

The following commit(s) were added to refs/heads/master by this push:
       new  2b57135f3 IDP-1625 - CSRF token missing in Duo cancel request hyperlink
2b57135f3 is described below

commit 2b57135f3c6574c737912947f2ef3e09600148bf
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 24 16:03:36 2020 +0100

    IDP-1625 - CSRF token missing in Duo cancel request hyperlink
    
     - Add new csrf query param velocity fragment
     - Add csrf token to duo.vm cancel request hyperlink
    
    https://issues.shibboleth.net/jira/browse/IDP-1625
---
 idp-conf/src/main/resources/system/views/csrf/csrf-qparam.vm | 4 ++++
 idp-conf/src/main/resources/views/duo.vm                     | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/idp-conf/src/main/resources/system/views/csrf/csrf-qparam.vm b/idp-conf/src/main/resources/system/views/csrf/csrf-qparam.vm
new file mode 100644
index 000000000..3273c3e5a
--- /dev/null
+++ b/idp-conf/src/main/resources/system/views/csrf/csrf-qparam.vm
@@ -0,0 +1,4 @@
+##
+## Velocity template to add the CSRF token as a query parameter.
+##
+#if($csrfToken)&${csrfToken.parameterName}=${csrfToken.token}#{else}#end
diff --git a/idp-conf/src/main/resources/views/duo.vm b/idp-conf/src/main/resources/views/duo.vm
index d212df78b..2541bc6b3 100644
--- a/idp-conf/src/main/resources/views/duo.vm
+++ b/idp-conf/src/main/resources/views/duo.vm
@@ -62,7 +62,7 @@
             </form>
             
             <h3 style="text-align: center">
-                <a href="$flowExecutionUrl&_eventId=cancel">#springMessageText("idp.login.duoCancel", "Cancel this Request")</a>
+                <a href="$flowExecutionUrl&_eventId=cancel#parse("csrf/csrf-qparam.vm")">#springMessageText("idp.login.duoCancel", "Cancel this Request")</a>
             </h3>
           </div>
           <div class="column two">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.