Contrib.social

CSRF on entity.ultimate_cron_job.unlock route

Open on Drupal.org →
Created on 18 February 2025, 7 months ago

Problem/Motivation

The entity.ultimate_cron_job.unlock route is not protected against CSRF attacks.

Steps to reproduce

As an user that can post content, add this HTML in a page:

<img src="http://example.com/admin/config/system/cron/jobs/ultimate_cron_queue_locale_translation/unlock">

As another user with the "run cron jobs" permission, display this page: the job is unlocked without any confirmation.

Proposed resolution

Add the _csrf_token: 'TRUE' requirement to this route.

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

🇫🇷France prudloff Lille

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024