Skip to content

Commit dd83cfc

Browse files
wxiaoguangwxiaoguang
authored
Refactor CSRF token (#32216)
1 parent 368b088 commit dd83cfc

29 files changed

+90
-126
lines changed

‎routers/web/auth/auth.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func autoSignIn(ctx *context.Context) (bool, error) {
9898
return false, err
9999
}
100100

101-
ctx.Csrf.DeleteCookie(ctx)
101+
ctx.Csrf.PrepareForSessionUser(ctx)
102102
return true, nil
103103
}
104104

@@ -359,8 +359,8 @@ func handleSignInFull(ctx *context.Context, u *user_model.User, remember, obeyRe
359359
ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
360360
}
361361

362-
// Clear whatever CSRF cookie has right now, force to generate a new one
363-
ctx.Csrf.DeleteCookie(ctx)
362+
// force to generate a new CSRF token
363+
ctx.Csrf.PrepareForSessionUser(ctx)
364364

365365
// Register last login
366366
if err := user_service.UpdateUser(ctx, u, &user_service.UpdateOptions{SetLastLogin: true}); err != nil {
@@ -804,6 +804,8 @@ func handleAccountActivation(ctx *context.Context, user *user_model.User) {
804804
return
805805
}
806806

807+
ctx.Csrf.PrepareForSessionUser(ctx)
808+
807809
if err := resetLocale(ctx, user); err != nil {
808810
ctx.ServerError("resetLocale", err)
809811
return

‎routers/web/auth/oauth.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -358,8 +358,8 @@ func handleOAuth2SignIn(ctx *context.Context, source *auth.Source, u *user_model
358358
return
359359
}
360360

361-
// Clear whatever CSRF cookie has right now, force to generate a new one
362-
ctx.Csrf.DeleteCookie(ctx)
361+
// force to generate a new CSRF token
362+
ctx.Csrf.PrepareForSessionUser(ctx)
363363

364364
if err := resetLocale(ctx, u); err != nil {
365365
ctx.ServerError("resetLocale", err)

‎services/auth/auth.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,8 @@ func handleSignIn(resp http.ResponseWriter, req *http.Request, sess SessionStore
103103

104104
middleware.SetLocaleCookie(resp, user.Language, 0)
105105

106-
// Clear whatever CSRF has right now, force to generate a new one
106+
// force to generate a new CSRF token
107107
if ctx := gitea_context.GetWebContext(req); ctx != nil {
108-
ctx.Csrf.DeleteCookie(ctx)
108+
ctx.Csrf.PrepareForSessionUser(ctx)
109109
}
110110
}

‎services/context/csrf.go

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,10 +129,8 @@ func (c *csrfProtector) PrepareForSessionUser(ctx *Context) {
129129
}
130130

131131
if needsNew {
132-
// FIXME: actionId.
133132
c.token = GenerateCsrfToken(c.opt.Secret, c.id, "POST", time.Now())
134-
cookie := newCsrfCookie(&c.opt, c.token)
135-
ctx.Resp.Header().Add("Set-Cookie", cookie.String())
133+
ctx.Resp.Header().Add("Set-Cookie", newCsrfCookie(&c.opt, c.token).String())
136134
}
137135

138136
ctx.Data["CsrfToken"] = c.token

‎tests/integration/admin_user_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func testSuccessfullEdit(t *testing.T, formData user_model.User) {
5151

5252
func makeRequest(t *testing.T, formData user_model.User, headerCode int) {
5353
session := loginUser(t, "user1")
54-
csrf := GetCSRF(t, session, "/admin/users/"+strconv.Itoa(int(formData.ID))+"/edit")
54+
csrf := GetUserCSRFToken(t, session)
5555
req := NewRequestWithValues(t, "POST", "/admin/users/"+strconv.Itoa(int(formData.ID))+"/edit", map[string]string{
5656
"_csrf": csrf,
5757
"user_name": formData.Name,
@@ -72,7 +72,7 @@ func TestAdminDeleteUser(t *testing.T) {
7272

7373
session := loginUser(t, "user1")
7474

75-
csrf := GetCSRF(t, session, "/admin/users/8/edit")
75+
csrf := GetUserCSRFToken(t, session)
7676
req := NewRequestWithValues(t, "POST", "/admin/users/8/delete", map[string]string{
7777
"_csrf": csrf,
7878
})

‎tests/integration/api_httpsig_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func TestHTTPSigCert(t *testing.T) {
9595
defer tests.PrepareTestEnv(t)()
9696
session := loginUser(t, "user1")
9797

98-
csrf := GetCSRF(t, session, "/user/settings/keys")
98+
csrf := GetUserCSRFToken(t, session)
9999
req := NewRequestWithValues(t, "POST", "/user/settings/keys", map[string]string{
100100
"_csrf": csrf,
101101
"content": "user1",

‎tests/integration/api_packages_container_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -784,7 +784,7 @@ func TestPackageContainer(t *testing.T) {
784784
newOwnerName := "newUsername"
785785

786786
req := NewRequestWithValues(t, "POST", "/user/settings", map[string]string{
787-
"_csrf": GetCSRF(t, session, "/user/settings"),
787+
"_csrf": GetUserCSRFToken(t, session),
788788
"name": newOwnerName,
789789
"email": "[email protected]",
790790
"language": "en-US",
@@ -794,7 +794,7 @@ func TestPackageContainer(t *testing.T) {
794794
t.Run(fmt.Sprintf("Catalog[%s]", newOwnerName), checkCatalog(newOwnerName))
795795

796796
req = NewRequestWithValues(t, "POST", "/user/settings", map[string]string{
797-
"_csrf": GetCSRF(t, session, "/user/settings"),
797+
"_csrf": GetUserCSRFToken(t, session),
798798
"name": user.Name,
799799
"email": "[email protected]",
800800
"language": "en-US",

‎tests/integration/attachment_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,14 +57,14 @@ func createAttachment(t *testing.T, session *TestSession, csrf, repoURL, filenam
5757
func TestCreateAnonymousAttachment(t *testing.T) {
5858
defer tests.PrepareTestEnv(t)()
5959
session := emptyTestSession(t)
60-
createAttachment(t, session, GetCSRF(t, session, "/user/login"), "user2/repo1", "image.png", generateImg(), http.StatusSeeOther)
60+
createAttachment(t, session, GetAnonymousCSRFToken(t, session), "user2/repo1", "image.png", generateImg(), http.StatusSeeOther)
6161
}
6262

6363
func TestCreateIssueAttachment(t *testing.T) {
6464
defer tests.PrepareTestEnv(t)()
6565
const repoURL = "user2/repo1"
6666
session := loginUser(t, "user2")
67-
uuid := createAttachment(t, session, GetCSRF(t, session, repoURL), repoURL, "image.png", generateImg(), http.StatusOK)
67+
uuid := createAttachment(t, session, GetUserCSRFToken(t, session), repoURL, "image.png", generateImg(), http.StatusOK)
6868

6969
req := NewRequest(t, "GET", repoURL+"/issues/new")
7070
resp := session.MakeRequest(t, req, http.StatusOK)

‎tests/integration/auth_ldap_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ func addAuthSourceLDAP(t *testing.T, sshKeyAttribute, groupFilter string, groupM
156156
groupTeamMap = groupMapParams[1]
157157
}
158158
session := loginUser(t, "user1")
159-
csrf := GetCSRF(t, session, "/admin/auths/new")
159+
csrf := GetUserCSRFToken(t, session)
160160
req := NewRequestWithValues(t, "POST", "/admin/auths/new", buildAuthSourceLDAPPayload(csrf, sshKeyAttribute, groupFilter, groupTeamMap, groupTeamMapRemoval))
161161
session.MakeRequest(t, req, http.StatusSeeOther)
162162
}
@@ -252,7 +252,7 @@ func TestLDAPUserSyncWithEmptyUsernameAttribute(t *testing.T) {
252252
defer tests.PrepareTestEnv(t)()
253253

254254
session := loginUser(t, "user1")
255-
csrf := GetCSRF(t, session, "/admin/auths/new")
255+
csrf := GetUserCSRFToken(t, session)
256256
payload := buildAuthSourceLDAPPayload(csrf, "", "", "", "")
257257
payload["attribute_username"] = ""
258258
req := NewRequestWithValues(t, "POST", "/admin/auths/new", payload)
@@ -487,7 +487,7 @@ func TestLDAPPreventInvalidGroupTeamMap(t *testing.T) {
487487
defer tests.PrepareTestEnv(t)()
488488

489489
session := loginUser(t, "user1")
490-
csrf := GetCSRF(t, session, "/admin/auths/new")
490+
csrf := GetUserCSRFToken(t, session)
491491
req := NewRequestWithValues(t, "POST", "/admin/auths/new", buildAuthSourceLDAPPayload(csrf, "", "", `{"NOT_A_VALID_JSON"["MISSING_DOUBLE_POINT"]}`, "off"))
492492
session.MakeRequest(t, req, http.StatusOK) // StatusOK = failed, StatusSeeOther = ok
493493
}

‎tests/integration/change_default_branch_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,15 @@ func TestChangeDefaultBranch(t *testing.T) {
2222
session := loginUser(t, owner.Name)
2323
branchesURL := fmt.Sprintf("/%s/%s/settings/branches", owner.Name, repo.Name)
2424

25-
csrf := GetCSRF(t, session, branchesURL)
25+
csrf := GetUserCSRFToken(t, session)
2626
req := NewRequestWithValues(t, "POST", branchesURL, map[string]string{
2727
"_csrf": csrf,
2828
"action": "default_branch",
2929
"branch": "DefaultBranch",
3030
})
3131
session.MakeRequest(t, req, http.StatusSeeOther)
3232

33-
csrf = GetCSRF(t, session, branchesURL)
33+
csrf = GetUserCSRFToken(t, session)
3434
req = NewRequestWithValues(t, "POST", branchesURL, map[string]string{
3535
"_csrf": csrf,
3636
"action": "default_branch",

‎tests/integration/delete_user_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func TestUserDeleteAccount(t *testing.T) {
3333
defer tests.PrepareTestEnv(t)()
3434

3535
session := loginUser(t, "user8")
36-
csrf := GetCSRF(t, session, "/user/settings/account")
36+
csrf := GetUserCSRFToken(t, session)
3737
urlStr := fmt.Sprintf("/user/settings/account/delete?password=%s", userPassword)
3838
req := NewRequestWithValues(t, "POST", urlStr, map[string]string{
3939
"_csrf": csrf,
@@ -48,7 +48,7 @@ func TestUserDeleteAccountStillOwnRepos(t *testing.T) {
4848
defer tests.PrepareTestEnv(t)()
4949

5050
session := loginUser(t, "user2")
51-
csrf := GetCSRF(t, session, "/user/settings/account")
51+
csrf := GetUserCSRFToken(t, session)
5252
urlStr := fmt.Sprintf("/user/settings/account/delete?password=%s", userPassword)
5353
req := NewRequestWithValues(t, "POST", urlStr, map[string]string{
5454
"_csrf": csrf,

‎tests/integration/editor_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func TestCreateFileOnProtectedBranch(t *testing.T) {
4949
onGiteaRun(t, func(t *testing.T, u *url.URL) {
5050
session := loginUser(t, "user2")
5151

52-
csrf := GetCSRF(t, session, "/user2/repo1/settings/branches")
52+
csrf := GetUserCSRFToken(t, session)
5353
// Change master branch to protected
5454
req := NewRequestWithValues(t, "POST", "/user2/repo1/settings/branches/edit", map[string]string{
5555
"_csrf": csrf,
@@ -84,7 +84,7 @@ func TestCreateFileOnProtectedBranch(t *testing.T) {
8484
assert.Contains(t, resp.Body.String(), "Cannot commit to protected branch "master".")
8585

8686
// remove the protected branch
87-
csrf = GetCSRF(t, session, "/user2/repo1/settings/branches")
87+
csrf = GetUserCSRFToken(t, session)
8888

8989
// Change master branch to protected
9090
req = NewRequestWithValues(t, "POST", "/user2/repo1/settings/branches/1/delete", map[string]string{

‎tests/integration/empty_repo_test.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ import (
2929
func testAPINewFile(t *testing.T, session *TestSession, user, repo, branch, treePath, content string) *httptest.ResponseRecorder {
3030
url := fmt.Sprintf("/%s/%s/_new/%s", user, repo, branch)
3131
req := NewRequestWithValues(t, "POST", url, map[string]string{
32-
"_csrf": GetCSRF(t, session, "/user/settings"),
32+
"_csrf": GetUserCSRFToken(t, session),
3333
"commit_choice": "direct",
3434
"tree_path": treePath,
3535
"content": content,
@@ -63,7 +63,7 @@ func TestEmptyRepoAddFile(t *testing.T) {
6363
doc := NewHTMLParser(t, resp.Body).Find(`input[name="commit_choice"]`)
6464
assert.Empty(t, doc.AttrOr("checked", "_no_"))
6565
req = NewRequestWithValues(t, "POST", "/user30/empty/_new/"+setting.Repository.DefaultBranch, map[string]string{
66-
"_csrf": GetCSRF(t, session, "/user/settings"),
66+
"_csrf": GetUserCSRFToken(t, session),
6767
"commit_choice": "direct",
6868
"tree_path": "test-file.md",
6969
"content": "newly-added-test-file",
@@ -89,7 +89,7 @@ func TestEmptyRepoUploadFile(t *testing.T) {
8989

9090
body := &bytes.Buffer{}
9191
mpForm := multipart.NewWriter(body)
92-
_ = mpForm.WriteField("_csrf", GetCSRF(t, session, "/user/settings"))
92+
_ = mpForm.WriteField("_csrf", GetUserCSRFToken(t, session))
9393
file, _ := mpForm.CreateFormFile("file", "uploaded-file.txt")
9494
_, _ = io.Copy(file, bytes.NewBufferString("newly-uploaded-test-file"))
9595
_ = mpForm.Close()
@@ -101,7 +101,7 @@ func TestEmptyRepoUploadFile(t *testing.T) {
101101
assert.NoError(t, json.Unmarshal(resp.Body.Bytes(), &respMap))
102102

103103
req = NewRequestWithValues(t, "POST", "/user30/empty/_upload/"+setting.Repository.DefaultBranch, map[string]string{
104-
"_csrf": GetCSRF(t, session, "/user/settings"),
104+
"_csrf": GetUserCSRFToken(t, session),
105105
"commit_choice": "direct",
106106
"files": respMap["uuid"],
107107
"tree_path": "",

‎tests/integration/git_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -462,7 +462,7 @@ func doBranchProtectPRMerge(baseCtx *APITestContext, dstPath string) func(t *tes
462462
func doProtectBranch(ctx APITestContext, branch, userToWhitelistPush, userToWhitelistForcePush, unprotectedFilePatterns string) func(t *testing.T) {
463463
// We are going to just use the owner to set the protection.
464464
return func(t *testing.T) {
465-
csrf := GetCSRF(t, ctx.Session, fmt.Sprintf("/%s/%s/settings/branches", url.PathEscape(ctx.Username), url.PathEscape(ctx.Reponame)))
465+
csrf := GetUserCSRFToken(t, ctx.Session)
466466

467467
formData := map[string]string{
468468
"_csrf": csrf,
@@ -644,7 +644,7 @@ func doPushCreate(ctx APITestContext, u *url.URL) func(t *testing.T) {
644644

645645
func doBranchDelete(ctx APITestContext, owner, repo, branch string) func(*testing.T) {
646646
return func(t *testing.T) {
647-
csrf := GetCSRF(t, ctx.Session, fmt.Sprintf("/%s/%s/branches", url.PathEscape(owner), url.PathEscape(repo)))
647+
csrf := GetUserCSRFToken(t, ctx.Session)
648648

649649
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/branches/delete?name=%s", url.PathEscape(owner), url.PathEscape(repo), url.QueryEscape(branch)), map[string]string{
650650
"_csrf": csrf,

‎tests/integration/integration_test.go

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -486,23 +486,19 @@ func VerifyJSONSchema(t testing.TB, resp *httptest.ResponseRecorder, schemaFile
486486
assert.True(t, result.Valid())
487487
}
488488

489-
// GetCSRF returns CSRF token from body
490-
// If it fails, it means the CSRF token is not found in the response body returned by the url with the given session.
491-
// In this case, you should find a better url to get it.
492-
func GetCSRF(t testing.TB, session *TestSession, urlStr string) string {
489+
// GetUserCSRFToken returns CSRF token for current user
490+
func GetUserCSRFToken(t testing.TB, session *TestSession) string {
493491
t.Helper()
494-
req := NewRequest(t, "GET", urlStr)
495-
resp := session.MakeRequest(t, req, http.StatusOK)
496-
doc := NewHTMLParser(t, resp.Body)
497-
csrf := doc.GetCSRF()
498-
require.NotEmpty(t, csrf)
499-
return csrf
492+
cookie := session.GetCookie("_csrf")
493+
require.NotEmpty(t, cookie)
494+
return cookie.Value
500495
}
501496

502-
// GetCSRFFrom returns CSRF token from body
503-
func GetCSRFFromCookie(t testing.TB, session *TestSession, urlStr string) string {
497+
// GetUserCSRFToken returns CSRF token for anonymous user (not logged in)
498+
func GetAnonymousCSRFToken(t testing.TB, session *TestSession) string {
504499
t.Helper()
505-
req := NewRequest(t, "GET", urlStr)
506-
session.MakeRequest(t, req, http.StatusOK)
507-
return session.GetCookie("_csrf").Value
500+
resp := session.MakeRequest(t, NewRequest(t, "GET", "/user/login"), http.StatusOK)
501+
csrfToken := NewHTMLParser(t, resp.Body).GetCSRF()
502+
require.NotEmpty(t, csrfToken)
503+
return csrfToken
508504
}

‎tests/integration/issue_test.go

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -197,21 +197,21 @@ func TestEditIssue(t *testing.T) {
197197
issueURL := testNewIssue(t, session, "user2", "repo1", "Title", "Description")
198198

199199
req := NewRequestWithValues(t, "POST", fmt.Sprintf("%s/content", issueURL), map[string]string{
200-
"_csrf": GetCSRF(t, session, issueURL),
200+
"_csrf": GetUserCSRFToken(t, session),
201201
"content": "modified content",
202202
"context": fmt.Sprintf("/%s/%s", "user2", "repo1"),
203203
})
204204
session.MakeRequest(t, req, http.StatusOK)
205205

206206
req = NewRequestWithValues(t, "POST", fmt.Sprintf("%s/content", issueURL), map[string]string{
207-
"_csrf": GetCSRF(t, session, issueURL),
207+
"_csrf": GetUserCSRFToken(t, session),
208208
"content": "modified content",
209209
"context": fmt.Sprintf("/%s/%s", "user2", "repo1"),
210210
})
211211
session.MakeRequest(t, req, http.StatusBadRequest)
212212

213213
req = NewRequestWithValues(t, "POST", fmt.Sprintf("%s/content", issueURL), map[string]string{
214-
"_csrf": GetCSRF(t, session, issueURL),
214+
"_csrf": GetUserCSRFToken(t, session),
215215
"content": "modified content",
216216
"content_version": "1",
217217
"context": fmt.Sprintf("/%s/%s", "user2", "repo1"),
@@ -246,11 +246,11 @@ func TestIssueCommentDelete(t *testing.T) {
246246

247247
// Using the ID of a comment that does not belong to the repository must fail
248248
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d/delete", "user5", "repo4", commentID), map[string]string{
249-
"_csrf": GetCSRF(t, session, issueURL),
249+
"_csrf": GetUserCSRFToken(t, session),
250250
})
251251
session.MakeRequest(t, req, http.StatusNotFound)
252252
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d/delete", "user2", "repo1", commentID), map[string]string{
253-
"_csrf": GetCSRF(t, session, issueURL),
253+
"_csrf": GetUserCSRFToken(t, session),
254254
})
255255
session.MakeRequest(t, req, http.StatusOK)
256256
unittest.AssertNotExistsBean(t, &issues_model.Comment{ID: commentID})
@@ -270,13 +270,13 @@ func TestIssueCommentUpdate(t *testing.T) {
270270

271271
// Using the ID of a comment that does not belong to the repository must fail
272272
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d", "user5", "repo4", commentID), map[string]string{
273-
"_csrf": GetCSRF(t, session, issueURL),
273+
"_csrf": GetUserCSRFToken(t, session),
274274
"content": modifiedContent,
275275
})
276276
session.MakeRequest(t, req, http.StatusNotFound)
277277

278278
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d", "user2", "repo1", commentID), map[string]string{
279-
"_csrf": GetCSRF(t, session, issueURL),
279+
"_csrf": GetUserCSRFToken(t, session),
280280
"content": modifiedContent,
281281
})
282282
session.MakeRequest(t, req, http.StatusOK)
@@ -298,21 +298,21 @@ func TestIssueCommentUpdateSimultaneously(t *testing.T) {
298298
modifiedContent := comment.Content + "MODIFIED"
299299

300300
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d", "user2", "repo1", commentID), map[string]string{
301-
"_csrf": GetCSRF(t, session, issueURL),
301+
"_csrf": GetUserCSRFToken(t, session),
302302
"content": modifiedContent,
303303
})
304304
session.MakeRequest(t, req, http.StatusOK)
305305

306306
modifiedContent = comment.Content + "2"
307307

308308
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d", "user2", "repo1", commentID), map[string]string{
309-
"_csrf": GetCSRF(t, session, issueURL),
309+
"_csrf": GetUserCSRFToken(t, session),
310310
"content": modifiedContent,
311311
})
312312
session.MakeRequest(t, req, http.StatusBadRequest)
313313

314314
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d", "user2", "repo1", commentID), map[string]string{
315-
"_csrf": GetCSRF(t, session, issueURL),
315+
"_csrf": GetUserCSRFToken(t, session),
316316
"content": modifiedContent,
317317
"content_version": "1",
318318
})

‎tests/integration/mirror_push_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ func testMirrorPush(t *testing.T, u *url.URL) {
8181

8282
func doCreatePushMirror(ctx APITestContext, address, username, password string) func(t *testing.T) {
8383
return func(t *testing.T) {
84-
csrf := GetCSRF(t, ctx.Session, fmt.Sprintf("/%s/%s/settings", url.PathEscape(ctx.Username), url.PathEscape(ctx.Reponame)))
84+
csrf := GetUserCSRFToken(t, ctx.Session)
8585

8686
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/settings", url.PathEscape(ctx.Username), url.PathEscape(ctx.Reponame)), map[string]string{
8787
"_csrf": csrf,
@@ -101,7 +101,7 @@ func doCreatePushMirror(ctx APITestContext, address, username, password string)
101101

102102
func doRemovePushMirror(ctx APITestContext, address, username, password string, pushMirrorID int) func(t *testing.T) {
103103
return func(t *testing.T) {
104-
csrf := GetCSRF(t, ctx.Session, fmt.Sprintf("/%s/%s/settings", url.PathEscape(ctx.Username), url.PathEscape(ctx.Reponame)))
104+
csrf := GetUserCSRFToken(t, ctx.Session)
105105

106106
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/settings", url.PathEscape(ctx.Username), url.PathEscape(ctx.Reponame)), map[string]string{
107107
"_csrf": csrf,

0 commit comments

Comments
 (0)