Skip to content

Commit 3f19613

Browse files
author
Marius Cramer
committed
Merge branch 'stable-3.0.5' into 'stable-3.0.5'
Stable 3.0.5 Fixes See merge request !197
2 parents d7ababc + f3cc2c3 commit 3f19613

File tree

5 files changed

+71
-5
lines changed

5 files changed

+71
-5
lines changed

‎interface/lib/classes/tform.inc.php‎

Lines changed: 65 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,6 @@ function loadFormDef($file, $module = '') {
157157
return true;
158158
}
159159

160-
161160
/**
162161
* Converts the data in the array to human readable format
163162
* Datatype conversion e.g. to show the data in lists
@@ -384,7 +383,31 @@ function getHTML($record, $tab, $action = 'NEW') {
384383

385384
if(!is_array($this->formDef)) $app->error("No form definition found.");
386385
if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab).");
387-
386+
387+
/* CSRF PROTECTION */
388+
// generate csrf protection id and key
389+
$_csrf_id = uniqid($this->formDef['name'] . '_');
390+
$_csrf_value = sha1(uniqid(microtime(true), true));
391+
if(!isset($_SESSION['_csrf'])) $_SESSION['_csrf'] = array();
392+
if(!isset($_SESSION['_csrf_timeout'])) $_SESSION['_csrf_timeout'] = array();
393+
$_SESSION['_csrf'][$_csrf_id] = $_csrf_value;
394+
$_SESSION['_csrf_timeout'][$_csrf_id] = time() + 3600; // timeout hash in 1 hour
395+
$this->formDef['tabs'][$tab]['fields']['_csrf_id'] = array(
396+
'datatype' => 'VARCHAR',
397+
'formtype' => 'TEXT',
398+
'default' => $_csrf_id,
399+
'value' => $_csrf_id
400+
);
401+
$this->formDef['tabs'][$tab]['fields']['_csrf_key'] = array(
402+
'datatype' => 'VARCHAR',
403+
'formtype' => 'TEXT',
404+
'default' => $_csrf_value,
405+
'value' => $_csrf_value
406+
);
407+
$record['_csrf_id'] = $_csrf_id;
408+
$record['_csrf_key'] = $_csrf_value;
409+
/* CSRF PROTECTION */
410+
388411
$new_record = array();
389412
if($action == 'EDIT') {
390413
$record = $this->decode($record, $tab);
@@ -644,7 +667,46 @@ function encode($record, $tab, $dbencode = true) {
644667

645668
if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab is empty or does not exist (TAB: $tab).");
646669
//$this->errorMessage = '';
647-
670+
671+
/* CSRF PROTECTION */
672+
if(isset($_POST) && is_array($_POST)) {
673+
$_csrf_valid = false;
674+
if(isset($_POST['_csrf_id']) && isset($_POST['_csrf_key'])) {
675+
$_csrf_id = trim($_POST['_csrf_id']);
676+
$_csrf_key = trim($_POST['_csrf_key']);
677+
if(isset($_SESSION['_csrf']) && isset($_SESSION['_csrf'][$_csrf_id]) && isset($_SESSION['_csrf_timeout']) && isset($_SESSION['_csrf_timeout'][$_csrf_id])) {
678+
if($_SESSION['_csrf'][$_csrf_id] === $_csrf_key && $_SESSION['_csrf_timeout'] >= time()) $_csrf_valid = true;
679+
}
680+
}
681+
if($_csrf_valid !== true) {
682+
$app->log('CSRF attempt blocked. Referer: ' . (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : 'unknown'), LOGLEVEL_WARN);
683+
$errmsg = 'err_csrf_attempt_blocked';
684+
$this->errorMessage .= ($api == true ? $errmsg : $this->wordbook[$errmsg]."<br />") . "\r\n";
685+
unset($_POST);
686+
unset($record);
687+
}
688+
$_SESSION['_csrf'][$_csrf_id] = null;
689+
$_SESSION['_csrf_timeout'][$_csrf_id] = null;
690+
unset($_SESSION['_csrf'][$_csrf_id]);
691+
unset($_SESSION['_csrf_timeout'][$_csrf_id]);
692+
693+
if(isset($_SESSION['_csrf_timeout']) && is_array($_SESSION['_csrf_timeout'])) {
694+
$to_unset = array();
695+
foreach($_SESSION['_csrf_timeout'] as $_csrf_id => $timeout) {
696+
if($timeout < time()) $to_unset[] = $_csrf_id;
697+
}
698+
foreach($to_unset as $_csrf_id) {
699+
$_SESSION['_csrf'][$_csrf_id] = null;
700+
$_SESSION['_csrf_timeout'][$_csrf_id] = null;
701+
unset($_SESSION['_csrf'][$_csrf_id]);
702+
unset($_SESSION['_csrf_timeout'][$_csrf_id]);
703+
}
704+
unset($to_unset);
705+
}
706+
}
707+
/* CSRF PROTECTION */
708+
709+
$new_record = array();
648710
if(is_array($record)) {
649711
foreach($this->formDef['tabs'][$tab]['fields'] as $key => $field) {
650712

‎interface/lib/lang/de.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ $wb['top_menu_domain'] = 'Domains';
4242
$wb['top_menu_dashboard'] = 'Übersicht';
4343
$wb['latest_news_txt'] = 'Neuigkeiten';
4444
$wb['top_menu_vm'] = 'vServer';
45+
$wb['err_csrf_attempt_blocked'] = 'CSRF-Versuch blockiert.';
4546
$wb['daynamesmin_su'] = 'So';
4647
$wb['daynamesmin_mo'] = 'Mo';
4748
$wb['daynamesmin_tu'] = 'Di';

‎interface/lib/lang/en.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ $wb['datalog_status_d_web_folder'] = 'Delete folder protection';
131131
$wb['datalog_status_i_web_folder_user'] = 'Create folder protection user';
132132
$wb['datalog_status_u_web_folder_user'] = 'Update folder protection user';
133133
$wb['datalog_status_d_web_folder_user'] = 'Delete folder protection user';
134+
$wb['err_csrf_attempt_blocked'] = 'CSRF attempt blocked.';
134135
$wb['login_as_txt'] = 'Log in as';
135136
$wb["no_domain_perm"] = 'You have no permission for this domain.';
136137
$wb["no_destination_perm"] = 'You have no permission for this destination.';

‎interface/web/monitor/show_sys_state.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ function _getServerState($serverId, $serverName) {
191191
/*
192192
* Get all monitoring-data from the server and process then
193193
*/
194-
$records = $app->db->queryAllRecords("SELECT DISTINCT type, data FROM monitor_data WHERE server_id = " . $serverId);
194+
$records = $app->db->queryAllRecords("SELECT DISTINCT type, data FROM monitor_data WHERE server_id = " . intval($serverId));
195195
$osData = null;
196196
$veInfo = null;
197197
$ispcData = null;
@@ -320,7 +320,7 @@ function _processDbState($type, $serverId, $serverState, $messages) {
320320
* state
321321
*/
322322
// get the State from the DB
323-
$record = $app->db->queryOneRecord("SELECT state FROM monitor_data WHERE type = '" . $type . "' and server_id = " . $serverId . " order by created desc");
323+
$record = $app->db->queryOneRecord("SELECT state FROM monitor_data WHERE type = '" . $app->db->quote($type) . "' and server_id = " . intval($serverId) . " order by created desc");
324324

325325
// change the new state to the highest state
326326
/*

‎interface/web/themes/default/templates/tabbed_form.tpl.htm‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,7 @@ <h2><tmpl_var name="form_hint"></h2>
2323
<tmpl_dyninclude name="content_tpl">
2424
</div>
2525

26+
<input type="hidden" name="_csrf_id" value="{tmpl_var name='_csrf_id'}" />
27+
<input type="hidden" name="_csrf_key" value="{tmpl_var name='_csrf_key'}" />
2628
<input type="hidden" name="next_tab" value="">
2729
<input type="hidden" name="phpsessid" value="{tmpl_var name='phpsessid'}">

0 commit comments

Comments
 (0)