mirror of
https://github.com/FOSSBilling/FOSSBilling.git
synced 2026-11-08 21:15:33 +09:00
Adam Daley
025ebc0850
* Harden guest session-state API calls against cross-site requests Extend the guest authentication guard to the session-bound cart mutations (cart add/remove item, promo apply/remove, reset, currency change), requiring the pre-login session nonce and a same-origin context like client login, signup, and staff login already do. Cart changes accept GET with the nonce in the query string, matching _checkCSRFToken()'s token sources, so shipped fb_api_link usage keeps working. Also pin an explicit SameSite=Lax on the session cookie when security.mode is not strict: an unset attribute leaves cookie behavior to each browser's default, and some browsers send cookies on cross-site requests when it is missing. The installer session already uses Lax. * Default queued cookies to SameSite Lax CookieQueue now defaults to Lax so locale and timezone preference cookies carry an explicit policy instead of leaving the behavior to each browser's unset-attribute default. The CSRF cookie keeps its explicit Strict, and callers can still pass null to omit the attribute. * Sign guest E2E requests with the pre-login nonce The Live Tests failures on the cart guard came from the test helper keeping its own copy of the guarded-endpoint list (login and signup only), so guest cart calls went out unsigned and were rejected with 403. Attach the nonce to every guest request instead - the dispatcher strips the parameter where it is not used - and let guest GET requests carry it in the query string, which _checkCSRFToken() already accepts. * Set the cURL URL after appending guest GET parameters CURLOPT_URL copies the value at set time, so mutating $url after curl_setopt_array() left the handle pointing at the query-less URL and guest GET requests went out without the nonce or parameters. Re-set CURLOPT_URL once the query string is appended.