shahondin1624/Mitgliederverwaltung
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 16 Wiki Activity

CSRF protection disabled on export endpoints with side effects #171

New Issue
Closed
opened 2026-04-10 16:04:10 +02:00 by shahondin1624 · 0 comments
shahondin1624 commented 2026-04-10 16:04:10 +02:00
Owner
Copy Link
Copy Source

Severity: LOW

Location

All controllers using #[NoCSRFRequired] on GET endpoints

Description

#[NoCSRFRequired] is appropriately used on GET (read-only) endpoints. However, some export/download endpoints that trigger actions or side effects also have this attribute (e.g., DSGVO export, report PDF downloads). This is standard Nextcloud practice for download endpoints but worth noting.

Recommendation

Verify that all #[NoCSRFRequired] endpoints are truly side-effect-free or require explicit user action.

## Severity: LOW ## Location All controllers using `#[NoCSRFRequired]` on GET endpoints ## Description `#[NoCSRFRequired]` is appropriately used on GET (read-only) endpoints. However, some export/download endpoints that trigger actions or side effects also have this attribute (e.g., DSGVO export, report PDF downloads). This is standard Nextcloud practice for download endpoints but worth noting. ## Recommendation Verify that all `#[NoCSRFRequired]` endpoints are truly side-effect-free or require explicit user action.
shahondin1624 added the backendsecuritypriority:low labels 2026-04-10 16:04:10 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
backend
Backend / PHP work
 bug
Bug report
 database
Database migrations and schema
 documentation
Documentation
 enhancement
Enhancement or improvement
 epic
Epic / feature-group issues
 frontend
Frontend / Vue.js work
 integration
Nextcloud integrations (Calendar, Contacts, Files)
 priority:high
High priority
 priority:low
Low priority
 priority:medium
Medium priority
 security
Security-related work
 testing
Tests and test infrastructure
No Label backend priority:low security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
shahondin1624
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shahondin1624/Mitgliederverwaltung#171
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?