Werk #13903: Introduce additional CSRF checks

Komponente Setup
Titel Introduce additional CSRF checks
Datum 16.05.2022
Checkmk-Editon Checkmk Raw (CRE)
Checkmk-Version 2.2.0i1 2.1.0p2 2.0.0p26
Level Kleine Änderung
Klasse Sicherheitsfix
Kompatibilität Kompatibel - benötigt kein manuelles Eingreifen

Previous to this Werk most data changing requests needed a transaction id. This mechanism was not used in all methods and in some cases the transaction id mechanism was not a good fit. So now a new CSRF token is introduced and checks are implemented in various locations.

If you scripted the UI you need to parse the CSRF token from the HTML and send it with the Post requests.

Please note: Updating to 2.0.0p26 or newer is a compatible change. You don't have to do anything. However, this change introduces new data fields in the user sessions which makes this change "incompatible" in case you want to downgrade to an older version. In case you have to do it, you will have to clean up all files in [SITE]/var/check_mk/web/[USER]/session_info.mk.

Zur Liste aller Werks