mirror of
https://gitlab.archlinux.org/archlinux/aurweb.git
synced 2025-02-03 10:43:03 +01:00
Implement token system to fix CSRF vulnerabilities
Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
canyonknight
Lukas Fleischer
parent
bfb25807c4
commit
2c93f0a98f
13 changed files with 82 additions and 46 deletions
|
|
@ -88,11 +88,13 @@ if (isset($_COOKIE["AURSID"])) {
|
|||
} elseif ($action == "UpdateAccount") {
|
||||
# user is submitting their modifications to an existing account
|
||||
#
|
||||
process_account_form($atype, "edit", "UpdateAccount",
|
||||
in_request("U"), in_request("T"), in_request("S"),
|
||||
in_request("E"), in_request("P"), in_request("C"),
|
||||
in_request("R"), in_request("L"), in_request("I"),
|
||||
in_request("ID"));
|
||||
if (check_token()) {
|
||||
process_account_form($atype, "edit", "UpdateAccount",
|
||||
in_request("U"), in_request("T"), in_request("S"),
|
||||
in_request("E"), in_request("P"), in_request("C"),
|
||||
in_request("R"), in_request("L"), in_request("I"),
|
||||
in_request("ID"));
|
||||
}
|
||||
|
||||
|
||||
} else {
|
||||
|
|
|
|||
|
|
@ -16,7 +16,11 @@ if (isset($_COOKIE["AURSID"])) {
|
|||
if ($atype == "Trusted User" OR $atype == "Developer") {
|
||||
$dbh = db_connect();
|
||||
|
||||
if (!empty($_POST['addVote'])) {
|
||||
if (!empty($_POST['addVote']) && !check_token()) {
|
||||
$error = __("Invalid token for user action.");
|
||||
}
|
||||
|
||||
if (!empty($_POST['addVote']) && check_token()) {
|
||||
$error = "";
|
||||
|
||||
if (!empty($_POST['user'])) {
|
||||
|
|
@ -99,6 +103,7 @@ if ($atype == "Trusted User" OR $atype == "Developer") {
|
|||
<b><?php print __('Proposal') ?></b><br />
|
||||
<textarea name='agenda' rows='25' cols='80'><?php if (!empty($_POST['agenda'])) { print htmlentities($_POST['agenda']); } ?></textarea><br />
|
||||
<input type='hidden' name='addVote' value='1' />
|
||||
<input type='hidden' name='token' value='<?php print htmlspecialchars($_COOKIE['AURSID']) ?>' />
|
||||
<input type='submit' class='button' value='<?php print __('Submit'); ?>' />
|
||||
</p>
|
||||
</form>
|
||||
|
|
|
|||
|
|
@ -36,46 +36,48 @@ if (isset($_POST['IDs'])) {
|
|||
|
||||
# Determine what action to do
|
||||
$output = "";
|
||||
if (current_action("do_Flag")) {
|
||||
$output = pkg_flag($atype, $ids, true);
|
||||
} elseif (current_action("do_UnFlag")) {
|
||||
$output = pkg_flag($atype, $ids, False);
|
||||
} elseif (current_action("do_Adopt")) {
|
||||
$output = pkg_adopt($atype, $ids, true);
|
||||
} elseif (current_action("do_Disown")) {
|
||||
$output = pkg_adopt($atype, $ids, False);
|
||||
} elseif (current_action("do_Vote")) {
|
||||
$output = pkg_vote($atype, $ids, true);
|
||||
} elseif (current_action("do_UnVote")) {
|
||||
$output = pkg_vote($atype, $ids, False);
|
||||
} elseif (current_action("do_Delete")) {
|
||||
if (isset($_POST['confirm_Delete'])) {
|
||||
if (!isset($_POST['merge_Into']) || empty($_POST['merge_Into'])) {
|
||||
$output = pkg_delete($atype, $ids, NULL);
|
||||
unset($_GET['ID']);
|
||||
}
|
||||
else {
|
||||
$mergepkgid = pkgid_from_name($_POST['merge_Into']);
|
||||
if ($mergepkgid) {
|
||||
$output = pkg_delete($atype, $ids, $mergepkgid);
|
||||
if (check_token()) {
|
||||
if (current_action("do_Flag")) {
|
||||
$output = pkg_flag($atype, $ids, true);
|
||||
} elseif (current_action("do_UnFlag")) {
|
||||
$output = pkg_flag($atype, $ids, False);
|
||||
} elseif (current_action("do_Adopt")) {
|
||||
$output = pkg_adopt($atype, $ids, true);
|
||||
} elseif (current_action("do_Disown")) {
|
||||
$output = pkg_adopt($atype, $ids, False);
|
||||
} elseif (current_action("do_Vote")) {
|
||||
$output = pkg_vote($atype, $ids, true);
|
||||
} elseif (current_action("do_UnVote")) {
|
||||
$output = pkg_vote($atype, $ids, False);
|
||||
} elseif (current_action("do_Delete")) {
|
||||
if (isset($_POST['confirm_Delete'])) {
|
||||
if (!isset($_POST['merge_Into']) || empty($_POST['merge_Into'])) {
|
||||
$output = pkg_delete($atype, $ids, NULL);
|
||||
unset($_GET['ID']);
|
||||
}
|
||||
else {
|
||||
$output = __("Cannot find package to merge votes and comments into.");
|
||||
$mergepkgid = pkgid_from_name($_POST['merge_Into']);
|
||||
if ($mergepkgid) {
|
||||
$output = pkg_delete($atype, $ids, $mergepkgid);
|
||||
unset($_GET['ID']);
|
||||
}
|
||||
else {
|
||||
$output = __("Cannot find package to merge votes and comments into.");
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
$output = __("The selected packages have not been deleted, check the confirmation checkbox.");
|
||||
}
|
||||
} elseif (current_action("do_Notify")) {
|
||||
$output = pkg_notify($atype, $ids);
|
||||
} elseif (current_action("do_UnNotify")) {
|
||||
$output = pkg_notify($atype, $ids, False);
|
||||
} elseif (current_action("do_DeleteComment")) {
|
||||
$output = pkg_delete_comment($atype);
|
||||
} elseif (current_action("do_ChangeCategory")) {
|
||||
$output = pkg_change_category($atype);
|
||||
}
|
||||
else {
|
||||
$output = __("The selected packages have not been deleted, check the confirmation checkbox.");
|
||||
}
|
||||
} elseif (current_action("do_Notify")) {
|
||||
$output = pkg_notify($atype, $ids);
|
||||
} elseif (current_action("do_UnNotify")) {
|
||||
$output = pkg_notify($atype, $ids, False);
|
||||
} elseif (current_action("do_DeleteComment")) {
|
||||
$output = pkg_delete_comment($atype);
|
||||
} elseif (current_action("do_ChangeCategory")) {
|
||||
$output = pkg_change_category($atype);
|
||||
}
|
||||
|
||||
html_header($title);
|
||||
|
|
|
|||
|
|
@ -27,9 +27,16 @@ if ($uid):
|
|||
|
||||
if (isset($_REQUEST['pkgsubmit'])) {
|
||||
|
||||
# Make sure authenticated user submitted the package themselves
|
||||
if (!check_token()) {
|
||||
$error = __("Invalid token for user action.");
|
||||
}
|
||||
|
||||
# Before processing, make sure we even have a file
|
||||
if ($_FILES['pfile']['size'] == 0){
|
||||
$error = __("Error - No file uploaded");
|
||||
if (!$error) {
|
||||
if ($_FILES['pfile']['size'] == 0){
|
||||
$error = __("Error - No file uploaded");
|
||||
}
|
||||
}
|
||||
|
||||
# Check whether the file is gzip'ed
|
||||
|
|
@ -448,7 +455,8 @@ html_header("Submit");
|
|||
?>
|
||||
|
||||
<form action='pkgsubmit.php' method='post' enctype='multipart/form-data'>
|
||||
<div> <input type='hidden' name='pkgsubmit' value='1' /> </div>
|
||||
<div> <input type='hidden' name='pkgsubmit' value='1' />
|
||||
<input type='hidden' name='token' value='<?php print htmlspecialchars($_COOKIE['AURSID']) ?>' /> </div>
|
||||
<table border='0' cellspacing='5'>
|
||||
<tr>
|
||||
<td class='f4' align='right'><?php print __("Package Category"); ?>:</td>
|
||||
|
|
|
|||
|
|
@ -72,7 +72,7 @@ if ($atype == "Trusted User" OR $atype == "Developer") {
|
|||
}
|
||||
|
||||
if ($canvote == 1) {
|
||||
if (isset($_POST['doVote'])) {
|
||||
if (isset($_POST['doVote']) && check_token()) {
|
||||
if (isset($_POST['voteYes'])) {
|
||||
$myvote = "Yes";
|
||||
} else if (isset($_POST['voteNo'])) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue