Bug 1430835 – CSRF tokens are erroneously being checked for external authentication

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1430835 - CSRF tokens are erroneously being checked for external authentication

Summary:	CSRF tokens are erroneously being checked for external authentication

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat CloudForms Management Engine
Classification:	Red Hat
Component:	UI - OPS (Show other bugs)
Sub Component:
Version:	5.7.0
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	GA
Target Release:	5.7.2
Assigned To:	Martin Povolny
QA Contact:	Matt Pusateri
Docs Contact:

URL:
Whiteboard:	auth:externalauth
Keywords:	ZStream

Depends On:	1429011
Blocks:
	Show dependency tree / graph

Reported:	2017-03-09 11:50 EST by Satoe Imaishi
Modified:	2017-04-12 10:44 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	5.7.2.0
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:	1429011
Environment:
Last Closed:	2017-04-12 10:44:24 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	CFME Core

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0898	normal	SHIPPED_LIVE	Moderate: cfme, cfme-appliance, and cfme-gemset security, bug fix, and enhancement update	2017-04-12 14:31:08 EDT

Groups: None (edit)

Comment 2 CFME Bot 2017-03-09 13:31:10 EST

New commit detected on ManageIQ/manageiq/euwe:
https://github.com/ManageIQ/manageiq/commit/337e83a28256a149aa8a61bec71cb2af2e57796f

commit 337e83a28256a149aa8a61bec71cb2af2e57796f
Author:     Milan Zázrivec <mzazrivec@redhat.com>
AuthorDate: Wed Mar 8 09:42:12 2017 +0100
Commit:     Satoe Imaishi <simaishi@redhat.com>
CommitDate: Thu Mar 9 13:28:51 2017 -0500

    Merge pull request #595 from martinpovolny/csrf_skip
    
    Adding an exception for forgery token for external auth.
    (cherry picked from commit 5fa64da998d2d758e289afb6a19d626ea3bc6f3d)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1430835

 app/controllers/application_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comment 3 Matt Pusateri 2017-04-03 10:01:35 EDT

Verified against 5.7.2.0 FreeIPA/AD auth providers

Comment 4 errata-xmlrpc 2017-04-12 10:44:24 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:0898

Note You need to log in before you can comment on or make changes to this bug.