diff --git a/lib/controller/controller.py b/lib/controller/controller.py index 9cdc3534d..bc9e20e3a 100644 --- a/lib/controller/controller.py +++ b/lib/controller/controller.py @@ -470,7 +470,19 @@ def start(): paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place + csrfTokenPattern = r"" + strings = conf.csrfToken.split("*") + for index, string in enumerate(strings): + csrfTokenPattern += re.escape(string) + if index < len(strings) - 1: + csrfTokenPattern += ".*" + for parameter, value in paramDict.items(): + if (re.match(csrfTokenPattern, parameter)): + infoMsg = "skipping csrf parameter '%s'" % parameter + logger.info(infoMsg) + continue + if not proceed: break diff --git a/lib/request/connect.py b/lib/request/connect.py index d216feaf2..29f6dd3c8 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -249,7 +249,6 @@ class Connect(object): url = kwargs.get("url", None) or conf.url get = kwargs.get("get", None) - print get post = kwargs.get("post", None) method = kwargs.get("method", None) cookie = kwargs.get("cookie", None) @@ -773,11 +772,6 @@ class Connect(object): if not multipart: logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) - #if "Invalid csrf token." in page: - # print "Invalid CSRF Token!" - #else: - # print "Valid CSRF Token!" - return page, responseHeaders, code @staticmethod