wamo/gnu-social
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CSRF Protection for login and new notice. Ticket #503

Browse Source 
darcs-hash:20081111022330-462f3-810b2a86e6e209330ade628fc0e97df96151d496.gz
This commit is contained in:
zach 2008-11-10 21:23:30 -05:00
parent aac0605bd1
commit 1e8d26baec
4 changed files with 29 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
actions/login.php
View File

@ -37,8 +37,15 @@ class LoginAction extends Action {
} }
function check_login() { function check_login() {
# XXX: form token in $_SESSION to prevent XSS
# XXX: login throttle # XXX: login throttle
# CSRF protection - token set in common_notice_form()
$token = $this->trimmed('token');
if (!$token || $token != common_session_token()) {
$this->client_error(_('There was a problem with your session token. Try again, please.'));
return;
}
$nickname = common_canonical_nickname($this->trimmed('nickname')); $nickname = common_canonical_nickname($this->trimmed('nickname'));
$password = $this->arg('password'); $password = $this->arg('password');
if (common_check_user($nickname, $password)) { if (common_check_user($nickname, $password)) {
@ -104,6 +111,7 @@ class LoginAction extends Action {
_('Automatically login in the future; ' . _('Automatically login in the future; ' .
'not for shared computers!')); 'not for shared computers!'));
common_submit('submit', _('Login')); common_submit('submit', _('Login'));
common_hidden('token', common_session_token());
common_element_end('form'); common_element_end('form');
common_element_start('p'); common_element_start('p');
common_element('a', array('href' => common_local_url('recoverpassword')), common_element('a', array('href' => common_local_url('recoverpassword')),

7
actions/newnotice.php
View File

@ -36,6 +36,13 @@ class NewnoticeAction extends Action {
function save_new_notice() { function save_new_notice() {
# CSRF protection - token set in common_notice_form()
$token = $this->trimmed('token');
if (!$token || $token != common_session_token()) {
$this->client_error(_('There was a problem with your session token. Try again, please.'));
return;
}
$user = common_current_user(); $user = common_current_user();
assert($user); # XXX: maybe an error instead... assert($user); # XXX: maybe an error instead...
$content = $this->trimmed('status_textarea'); $content = $this->trimmed('status_textarea');

2
actions/noticesearch.php
View File

@ -142,6 +142,8 @@ class NoticesearchAction extends SearchAction {
'onclick' => 'doreply("'.$profile->nickname.'"); return false', 'onclick' => 'doreply("'.$profile->nickname.'"); return false',
'title' => _('reply'), 'title' => _('reply'),
'class' => 'replybutton')); 'class' => 'replybutton'));
common_hidden('posttoken', common_session_token());
common_raw('→'); common_raw('→');
common_element_end('a'); common_element_end('a');
common_element_end('p'); common_element_end('p');

3
lib/util.php
View File

@ -1353,12 +1353,13 @@ function common_notice_form($action=NULL, $content=NULL) {
common_element('label', array('for' => 'status_textarea', common_element('label', array('for' => 'status_textarea',
'id' => 'status_label'), 'id' => 'status_label'),
sprintf(_('What\'s up, %s?'), $user->nickname)); sprintf(_('What\'s up, %s?'), $user->nickname));
common_element('span', array('id' => 'counter', 'class' => 'counter'), '140'); common_element('span', array('id' => 'counter', 'class' => 'counter'), '140');
common_element('textarea', array('id' => 'status_textarea', common_element('textarea', array('id' => 'status_textarea',
'cols' => 60, 'cols' => 60,
'rows' => 3, 'rows' => 3,
'name' => 'status_textarea'), 'name' => 'status_textarea'),
($content) ? $content : ''); ($content) ? $content : '');
common_hidden('token', common_session_token());
if ($action) { if ($action) {
common_hidden('returnto', $action); common_hidden('returnto', $action);
} }