From 11b5e6b82dcd3b876db7ca3c075442880eb19353 Mon Sep 17 00:00:00 2001
From: nao-pon <1412630+nao-pon@users.noreply.github.com>
Date: Tue, 21 Apr 2026 18:11:59 +0900
Subject: [PATCH] fix(connector): refine CSRF token refresh timing and
 protected commands

- refresh CSRF TTL after successful open/info/protected commands
- extend token lifetime on open requests during normal navigation
- limit CSRF protection to stable write commands
- fix callback script syntax in OAuth popup handling
---
 php/elFinder.class.php          |  2 +-
 php/elFinderConnector.class.php | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/php/elFinder.class.php b/php/elFinder.class.php
index b7eec12f1..2442e2860 100644
--- a/php/elFinder.class.php
+++ b/php/elFinder.class.php
@@ -4212,7 +4212,7 @@ class elFinder
                 $origin = isset($_SERVER['HTTP_ORIGIN'])? str_replace('\'', '\\\'', $_SERVER['HTTP_ORIGIN']) : '*';
                 $script .= '
 var go = function() {
-    var w = window.opener || window.parent || window,
+    var w = window.opener || window.parent || window;
     var closeWindow = function(){
         try {
             window.close();
diff --git a/php/elFinderConnector.class.php b/php/elFinderConnector.class.php
index 00173088a..41d1c525f 100644
--- a/php/elFinderConnector.class.php
+++ b/php/elFinderConnector.class.php
@@ -79,13 +79,10 @@ class elFinderConnector
     protected static $csrfProtectedCmds = array(
         'archive' => true,
         'chmod' => true,
-        'dim' => true,
         'duplicate' => true,
-        'editor' => true,
         'extract' => true,
         'mkdir' => true,
         'mkfile' => true,
-        'netmount' => true,
         'paste' => true,
         'put' => true,
         'rename' => true,
@@ -147,7 +144,10 @@ class elFinderConnector
      */
     protected function shouldRefreshCsrfToken($cmd, array $src)
     {
-        return ($cmd === 'info' && !empty($src['reload']));
+        return (
+            ($cmd === 'info' && !empty($src['reload']))
+            || $cmd === 'open'
+        );
     }
 
     /**
@@ -373,10 +373,6 @@ class elFinderConnector
             $this->output(array('error' => $this->elFinder->error(elFinder::ERROR_UNKNOWN_CMD)));
         }
 
-        if ($this->shouldRefreshCsrfToken($cmd, $src)) {
-            $this->refreshCsrfTokenTtl();
-        }
-
         if ($this->csrfProtectedCommand($cmd)) {
             if (!$this->validateCsrfToken()) {
                 $this->outputCsrfError();
@@ -415,8 +411,12 @@ class elFinderConnector
 
         try {
             $result = $this->elFinder->exec($cmd, $args);
-            if ($this->shouldIssueCsrfToken($cmd, $src) && is_array($result) && !isset($result['error'])) {
-                $result[self::$csrfResponseKey] = $this->issueCsrfToken();
+            if (is_array($result) && !isset($result['error'])) {
+                if ($this->shouldIssueCsrfToken($cmd, $src)) {
+                    $result[self::$csrfResponseKey] = $this->issueCsrfToken();
+                } else if ($this->shouldRefreshCsrfToken($cmd, $src)) {
+                    $this->refreshCsrfTokenTtl();
+                }
             }
             $this->output($result);
         } catch (elFinderAbortException $e) {