[PM84]

This issue was identified during a penetration test. Neither adhocdebug.php nor the userdebug=1 URL parameter validated the sesskey, so the ad hoc debug mode of a user holding tool/userdebug:adhocdebug could be switched by a cross-site request (CSRF); this change requires a valid sesskey on both paths and adds it to the generated toggle link.

Compatibility note: the userdebug=1 shortcut mentioned in CHANGES.md now only takes effect together with &sesskey=<current sesskey>; without it the parameter is silently ignored (no error page). Covered by tests/hook_test.php (test_setdebug_without_sesskey, test_setdebug_with_sesskey); tests/behat/enable_adhoc_debug.feature uses the toggle link, which now carries the sesskey.

[grabs]

Hi, thank you for providing this fix.
I wonder if someone is using the "userdebug" parameter at all. So I would suggest to remove this part completely.
What do you think?

[PM84]

Thanks for looking into this! We actually use the userdebug parameter a lot. On our large instance (more than 650,000 active users), switching on debugging site-wide immediately causes error messages that end up as support requests, so being able to enable it ad hoc for a single session is really helpful for us. We would therefore prefer to keep the parameter and only protect it with the sesskey.

[grabs]

Hi, I'm not quite convinced that we need the 'userdebug' parameter. Ad-hoc debugging doesn't really rely on it, and it forces the user to find the sesskey themselves. Can you give me an example of a use case for the 'userdebug' parameter?