From cb534c704e74e30f8ef63aeed51f961b6ee5b933 Mon Sep 17 00:00:00 2001
From: Daniel Schalla <daniel@schalla.me>
Date: Wed, 17 Jul 2019 15:08:58 +0200
Subject: [PATCH] Enhance logging of CSRF Warning (#11630)

---
 app/plugin_requests.go | 19 +++++++++++++++++--
 web/handlers.go        | 20 ++++++++++++++++++--
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/app/plugin_requests.go b/app/plugin_requests.go
index 715daf087f..208b564de0 100644
--- a/app/plugin_requests.go
+++ b/app/plugin_requests.go
@@ -119,10 +119,25 @@ func (a *App) servePluginRequest(w http.ResponseWriter, r *http.Request, handler
 			// ToDo(DSchalla) 2019/01/04: Remove after deprecation period and only allow CSRF Header (MM-13657)
 			if r.Header.Get(model.HEADER_REQUESTED_WITH) == model.HEADER_REQUESTED_WITH_XML && !csrfCheckPassed {
 				csrfErrorMessage := "CSRF Check failed for request - Please migrate your plugin to either send a CSRF Header or Form Field, XMLHttpRequest is deprecated"
+				sid := ""
+				userId := ""
+
+				if session != nil {
+					sid = session.Id
+					userId = session.UserId
+				}
+
+				fields := []mlog.Field{
+					mlog.String("path", r.URL.Path),
+					mlog.String("ip", r.RemoteAddr),
+					mlog.String("session_id", sid),
+					mlog.String("user_id", userId),
+				}
+
 				if *a.Config().ServiceSettings.ExperimentalStrictCSRFEnforcement {
-					a.Log.Warn(csrfErrorMessage)
+					a.Log.Warn(csrfErrorMessage, fields...)
 				} else {
-					a.Log.Debug(csrfErrorMessage)
+					a.Log.Debug(csrfErrorMessage, fields...)
 					csrfCheckPassed = true
 				}
 			}
diff --git a/web/handlers.go b/web/handlers.go
index db2d23e071..d9b8edbf3a 100644
--- a/web/handlers.go
+++ b/web/handlers.go
@@ -208,10 +208,26 @@ func (h *Handler) checkCSRFToken(c *Context, r *http.Request, token string, toke
 		} else if r.Header.Get(model.HEADER_REQUESTED_WITH) == model.HEADER_REQUESTED_WITH_XML {
 			// ToDo(DSchalla) 2019/01/04: Remove after deprecation period and only allow CSRF Header (MM-13657)
 			csrfErrorMessage := "CSRF Header check failed for request - Please upgrade your web application or custom app to set a CSRF Header"
+
+			sid := ""
+			userId := ""
+
+			if session != nil {
+				sid = session.Id
+				userId = session.UserId
+			}
+
+			fields := []mlog.Field{
+				mlog.String("path", r.URL.Path),
+				mlog.String("ip", r.RemoteAddr),
+				mlog.String("session_id", sid),
+				mlog.String("user_id", userId),
+			}
+
 			if *c.App.Config().ServiceSettings.ExperimentalStrictCSRFEnforcement {
-				c.Log.Warn(csrfErrorMessage)
+				c.Log.Warn(csrfErrorMessage, fields...)
 			} else {
-				c.Log.Debug(csrfErrorMessage)
+				c.Log.Debug(csrfErrorMessage, fields...)
 				csrfCheckPassed = true
 			}
 		}