src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: gate admin routes against cross-origin CSRF

Browse Source
This commit is contained in:
Linus Rath
2026-05-18 13:21:01 +02:00
parent b299a0b602
commit c2eb2c081b
16 changed files with 82 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/admin/plugins/[id]/config/route.ts
+3 -3
View File
@@ -34,7 +34,7 @@ export async function GET(
return NextResponse.json({ error: 'Invalid plugin ID' }, { status: 400 });
}
const adminAuth = await requireAdminAuth();
const adminAuth = await requireAdminAuth(request);
const isAdmin = !('error' in adminAuth);
if (!isAdmin) {
@@ -85,7 +85,7 @@ export async function PUT(
{ params }: { params: Promise<{ id: string }> },
) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const { id } = await params;
@@ -139,7 +139,7 @@ export async function DELETE(
{ params }: { params: Promise<{ id: string }> },
) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const { id } = await params;
app/api/admin/plugins/route.ts
+5 -5
View File
@@ -32,9 +32,9 @@ const SUSPICIOUS_JS_PATTERNS = [
/**
* GET /api/admin/plugins - List all admin-managed plugins
*/
export async function GET() {
export async function GET(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const [registry, devEntries] = await Promise.all([
@@ -64,7 +64,7 @@ export async function GET() {
*/
export async function POST(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const ip = getClientIP(request);
@@ -222,7 +222,7 @@ export async function POST(request: NextRequest) {
*/
export async function PATCH(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const ip = getClientIP(request);
@@ -264,7 +264,7 @@ export async function PATCH(request: NextRequest) {
*/
export async function DELETE(request: NextRequest) {
try {
const result = await requireAdminAuth();
const result = await requireAdminAuth(request);
if ('error' in result) return result.error;
const ip = getClientIP(request);