From aa8c20b22c24e3d7c475bc11e25b160996ae3db6 Mon Sep 17 00:00:00 2001
From: Carlos Romero <cromero@hiberus.com>
Date: Mon, 7 Apr 2025 11:04:53 +0200
Subject: [PATCH] Validate toolbar subtrees hash in AJAX responses
---
.../toolbar/src/Controller/ToolbarController.php | 10 ++++++----
core/modules/toolbar/toolbar.module | 2 +-
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/core/modules/toolbar/src/Controller/ToolbarController.php b/core/modules/toolbar/src/Controller/ToolbarController.php
index bcb36f8382b8..bd3f9d7b11ff 100644
--- a/core/modules/toolbar/src/Controller/ToolbarController.php
+++ b/core/modules/toolbar/src/Controller/ToolbarController.php
@@ -37,10 +37,13 @@ public function __construct(
*
* @return \Drupal\Core\Ajax\AjaxResponse
*/
- public function subtreesAjax() {
+ public function subtreesAjax($hash) {
[$subtrees] = toolbar_get_rendered_subtrees();
+ $expected_hash = _toolbar_get_subtrees_hash()[0];
$response = new AjaxResponse();
- $response->addCommand(new SetSubtreesCommand($subtrees));
+ if (hash_equals($expected_hash, $hash)) {
+ $response->addCommand(new SetSubtreesCommand($subtrees));
+ }
// The Expires HTTP header is the heart of the client-side HTTP caching. The
// additional server-side page cache only takes effect when the client
@@ -67,8 +70,7 @@ public function subtreesAjax() {
* The access result.
*/
public function checkSubTreeAccess($hash) {
- $expected_hash = _toolbar_get_subtrees_hash()[0];
- return AccessResult::allowedIf($this->currentUser()->hasPermission('access toolbar') && hash_equals($expected_hash, $hash))->cachePerPermissions();
+ return AccessResult::allowedIf($this->currentUser()->hasPermission('access toolbar'))->cachePerPermissions();
}
/**
diff --git a/core/modules/toolbar/toolbar.module b/core/modules/toolbar/toolbar.module
index ff395da0fcfc..915c36d03e68 100644
--- a/core/modules/toolbar/toolbar.module
+++ b/core/modules/toolbar/toolbar.module
@@ -293,6 +293,6 @@ function toolbar_get_rendered_subtrees() {
*/
function _toolbar_get_subtrees_hash() {
[$subtrees, $cacheability] = toolbar_get_rendered_subtrees();
- $hash = Crypt::hashBase64(serialize($subtrees));
+ $hash = Crypt::hashBase64(serialize(array_keys($subtrees)));
return [$hash, $cacheability];
}
--
GitLab