Require an HTTP Referer header in the server. Send one in ipa tools.

This is to prevent a Cross-Site Request Forgery (CSRF) attack where
a rogue server tricks a user who was logged into the FreeIPA
management interface into visiting a specially-crafted URL where
the attacker could perform FreeIPA oonfiguration changes with the
privileges of the logged-in user.

https://bugzilla.redhat.com/show_bug.cgi?id=747710

1 files changed, 17 insertions, 0 deletions

diff --git a/ipalib/errors.py b/ipalib/errors.py
index 4463fee70..5b634880d 100644
--- a/ipalib/errors.py
+++ b/ipalib/errors.py
@@ -441,6 +441,23 @@ class XMLRPCMarshallError(PublicError):
     errno = 910
     format = _('error marshalling data for XML-RPC transport: %(error)s')
 
+
+class RefererError(PublicError):
+    """
+    **911** Raised when the the request does not contain an HTTP referer
+
+    For example:
+
+    >>> raise RefererError()
+    Traceback (most recent call last):
+      ...
+    RefererError: Missing or invalid HTTP Referer
+    """
+
+    errno = 911
+    format = _('Missing or invalid HTTP Referer, %(referer)s')
+
+
 ##############################################################################
 # 1000 - 1999: Authentication errors
 class AuthenticationError(PublicError):