Outdated csrf-magic library

[onlyjob]

csrf-magic appears to be unmaintained/abandoned upstream. Yet, despite being untouched upstream in years we don't even use the latest version:

https://github.com/ZoneMinder/zoneminder/blob/master/web/includes/csrf/csrf-magic.php#L134

Here I've found v1.0.5: http://repo.or.cz/csrf-magic.git which can be cloned as follows

git clone http://repo.or.cz/csrf-magic.git

Please update it.

[SteveGilvarry]

Happy to compare but we are using this version I believe. More recent updates and activity from author, but no version update. https://github.com/ezyang/csrf-magic Will look closer over weekend.

…

On Fri, 6 Jul 2018 at 6:11 pm, Dmitry Smirnov ***@***.***> wrote: *csrf-magic* appears to be unmaintained/abandoned upstream. Yet, despite being untouched upstream in years we don't even use the latest version: https://github.com/ZoneMinder/zoneminder/blob/master/web/includes/csrf/csrf-magic.php#L134 Here I've found v1.0.5: http://repo.or.cz/csrf-magic.git whihch can be cloned as follows git clone http://repo.or.cz/csrf-magic.git Please update it. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2147>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHQrXAp4zB-4Z3SRdJHEkhZ7AkE4m5vLks5uDxuagaJpZM4VFDjv> .

[onlyjob]

Thanks. Let's clarify with upstream: ezyang/csrf-magic#14

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[onlyjob]

When legitimate bugs are closed like this I feel very discouraged from reporting more and I'm sure I'm not the only one. Closing tickets (without action) does not fix problems or make them go away.
This is just an incompetent bugs handling. :(

[netniV]

Just for reference, we use stale bot on our repositories too. If someone had responded with 7 days of the warning, it would have stayed open. But I see no point in leaving issues open that aren't active or being worked on.

I'm only here because I just posted an update to the CSRF stuff on my personal fork of it, to add some new features and allow us to move away from sha1 at some point in the future, and was looking at the source open issue list.