Skip to content

Commit 8cb6f8f

Browse files
author
Marius Cramer
committed
Merge branch 'stable-3.0.5'
Conflicts: install/sql/ispconfig3.sql install/tpl/config.inc.php.master interface/lib/classes/tform.inc.php interface/lib/config.inc.php interface/web/admin/server_config_edit.php interface/web/themes/blue/ispconfig_version interface/web/tools/import_plesk.php interface/web/tools/resync.php interface/web/vm/openvz_action.php
2 parents e97f841 + 4863035 commit 8cb6f8f

21 files changed

+181
-21
lines changed

‎interface/lib/classes/auth.inc.php‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,56 @@ public function crypt_password($cleartext_password) {
222222
$salt.="$";
223223
return crypt($cleartext_password, $salt);
224224
}
225+
226+
public function csrf_token_get($form_name) {
227+
/* CSRF PROTECTION */
228+
// generate csrf protection id and key
229+
$_csrf_id = uniqid($form_name . '_'); // form id
230+
$_csrf_key = sha1(uniqid(microtime(true), true)); // the key
231+
if(!isset($_SESSION['_csrf'])) $_SESSION['_csrf'] = array();
232+
if(!isset($_SESSION['_csrf_timeout'])) $_SESSION['_csrf_timeout'] = array();
233+
$_SESSION['_csrf'][$_csrf_id] = $_csrf_key;
234+
$_SESSION['_csrf_timeout'][$_csrf_id] = time() + 3600; // timeout hash in 1 hour
235+
236+
return array('csrf_id' => $_csrf_id,'csrf_key' => $_csrf_key);
237+
}
238+
239+
public function csrf_token_check() {
240+
global $app;
241+
242+
if(isset($_POST) && is_array($_POST)) {
243+
$_csrf_valid = false;
244+
if(isset($_POST['_csrf_id']) && isset($_POST['_csrf_key'])) {
245+
$_csrf_id = trim($_POST['_csrf_id']);
246+
$_csrf_key = trim($_POST['_csrf_key']);
247+
if(isset($_SESSION['_csrf']) && isset($_SESSION['_csrf'][$_csrf_id]) && isset($_SESSION['_csrf_timeout']) && isset($_SESSION['_csrf_timeout'][$_csrf_id])) {
248+
if($_SESSION['_csrf'][$_csrf_id] === $_csrf_key && $_SESSION['_csrf_timeout'] >= time()) $_csrf_valid = true;
249+
}
250+
}
251+
if($_csrf_valid !== true) {
252+
$app->log('CSRF attempt blocked. Referer: ' . (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : 'unknown'), LOGLEVEL_WARN);
253+
$app->error($app->lng('err_csrf_attempt_blocked'));
254+
}
255+
$_SESSION['_csrf'][$_csrf_id] = null;
256+
$_SESSION['_csrf_timeout'][$_csrf_id] = null;
257+
unset($_SESSION['_csrf'][$_csrf_id]);
258+
unset($_SESSION['_csrf_timeout'][$_csrf_id]);
259+
260+
if(isset($_SESSION['_csrf_timeout']) && is_array($_SESSION['_csrf_timeout'])) {
261+
$to_unset = array();
262+
foreach($_SESSION['_csrf_timeout'] as $_csrf_id => $timeout) {
263+
if($timeout < time()) $to_unset[] = $_csrf_id;
264+
}
265+
foreach($to_unset as $_csrf_id) {
266+
$_SESSION['_csrf'][$_csrf_id] = null;
267+
$_SESSION['_csrf_timeout'][$_csrf_id] = null;
268+
unset($_SESSION['_csrf'][$_csrf_id]);
269+
unset($_SESSION['_csrf_timeout'][$_csrf_id]);
270+
}
271+
unset($to_unset);
272+
}
273+
}
274+
}
225275

226276
}
227277

‎interface/lib/classes/tform_base.inc.php‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -416,12 +416,10 @@ function getHTML($record, $tab, $action = 'NEW') {
416416

417417
/* CSRF PROTECTION */
418418
// generate csrf protection id and key
419-
$_csrf_id = uniqid($this->formDef['name'] . '_');
420-
$_csrf_value = sha1(uniqid(microtime(true), true));
421-
if(!isset($_SESSION['_csrf'])) $_SESSION['_csrf'] = array();
422-
if(!isset($_SESSION['_csrf_timeout'])) $_SESSION['_csrf_timeout'] = array();
423-
$_SESSION['_csrf'][$_csrf_id] = $_csrf_value;
424-
$_SESSION['_csrf_timeout'][$_csrf_id] = time() + 3600; // timeout hash in 1 hour
419+
$csrf_token = $app->auth->csrf_token_get($this->formDef['name']);
420+
$_csrf_id = $csrf_token['csrf_id'];
421+
$_csrf_value = $csrf_token['csrf_key'];
422+
425423
$this->formDef['tabs'][$tab]['fields']['_csrf_id'] = array(
426424
'datatype' => 'VARCHAR',
427425
'formtype' => 'TEXT',
@@ -714,10 +712,6 @@ protected function _encode($record, $tab, $dbencode = true, $api = false) {
714712
unset($_POST);
715713
unset($record);
716714
}
717-
$_SESSION['_csrf'][$_csrf_id] = null;
718-
$_SESSION['_csrf_timeout'][$_csrf_id] = null;
719-
unset($_SESSION['_csrf'][$_csrf_id]);
720-
unset($_SESSION['_csrf_timeout'][$_csrf_id]);
721715

722716
if(isset($_SESSION['_csrf_timeout']) && is_array($_SESSION['_csrf_timeout'])) {
723717
$to_unset = array();

‎interface/lib/lang/de.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ $wb['top_menu_dashboard'] = 'Übersicht';
4343
$wb['latest_news_txt'] = 'Neuigkeiten';
4444
$wb['err_csrf_attempt_blocked'] = 'CSRF-Versuch blockiert.';
4545
$wb['top_menu_vm'] = 'vServer';
46+
$wb['err_csrf_attempt_blocked'] = 'CSRF-Versuch blockiert.';
4647
$wb['daynamesmin_su'] = 'So';
4748
$wb['daynamesmin_mo'] = 'Mo';
4849
$wb['daynamesmin_tu'] = 'Di';

‎interface/web/admin/language_add.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@
6565
$app->tpl->setVar('error', $error);
6666

6767
if(isset($_POST['lng_new']) && strlen($_POST['lng_new']) == 2 && $error == '') {
68+
69+
//* CSRF Check
70+
$app->auth->csrf_token_check();
71+
6872
$lng_new = $_POST['lng_new'];
6973
if(!preg_match("/^[a-z]{2}$/i", $lng_new)) die('unallowed characters in language name.');
7074

@@ -94,6 +98,11 @@
9498

9599
$app->tpl->setVar('msg', $msg);
96100

101+
//* SET csrf token
102+
$csrf_token = $app->auth->csrf_token_get('language_add');
103+
$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']);
104+
$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']);
105+
97106
//* load language file
98107
$lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_add.lng';
99108
include $lng_file;

‎interface/web/admin/language_complete.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@
6767
// Export the language file
6868
if(isset($_POST['lng_select']) && $error == '') {
6969

70+
//* CSRF Check
71+
$app->auth->csrf_token_check();
72+
7073
// complete the global langauge file
7174
merge_langfile(ISPC_LIB_PATH."/lang/".$selected_language.".lng", ISPC_LIB_PATH."/lang/en.lng");
7275

@@ -157,6 +160,11 @@ function merge_langfile($langfile, $masterfile) {
157160

158161
$app->tpl->setVar('msg', $msg);
159162

163+
//* SET csrf token
164+
$csrf_token = $app->auth->csrf_token_get('language_merge');
165+
$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']);
166+
$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']);
167+
160168
//* load language file
161169
$lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_complete.lng';
162170
include $lng_file;

‎interface/web/admin/language_edit.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@
5555

5656
//* Save data
5757
if(isset($_POST['records']) && is_array($_POST['records'])) {
58+
59+
//* CSRF Check
60+
$app->auth->csrf_token_check();
61+
5862
$file_content = "<?php\n";
5963
foreach($_POST['records'] as $key => $val) {
6064
$val = stripslashes($val);
@@ -93,6 +97,11 @@
9397
unset($wb);
9498
}
9599

100+
//* SET csrf token
101+
$csrf_token = $app->auth->csrf_token_get('language_edit');
102+
$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']);
103+
$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']);
104+
96105

97106
//* load language file
98107
$lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_edit.lng';

‎interface/web/admin/language_import.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,10 @@ function validate_line($line) {
129129

130130
// Export the language file
131131
if(isset($_FILES['file']['name']) && is_uploaded_file($_FILES['file']['tmp_name'])) {
132+
133+
//* CSRF Check
134+
$app->auth->csrf_token_check();
135+
132136
$lines = file($_FILES['file']['tmp_name']);
133137
// initial check
134138
$parts = explode('|', $lines[0]);
@@ -183,6 +187,11 @@ function validate_line($line) {
183187
$app->tpl->setVar('msg', $msg);
184188
$app->tpl->setVar('error', $error);
185189

190+
//* SET csrf token
191+
$csrf_token = $app->auth->csrf_token_get('language_import');
192+
$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']);
193+
$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']);
194+
186195
//* load language file
187196
$lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_import.lng';
188197
include $lng_file;

‎interface/web/admin/remote_action_ispcupdate.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@
6666

6767
//* Note: Disabled post action
6868
if (1 == 0 && isset($_POST['server_select'])) {
69+
70+
//* CSRF Check
71+
$app->auth->csrf_token_check();
72+
6973
$server = $_POST['server_select'];
7074
$servers = array();
7175
if ($server == '*') {
@@ -88,6 +92,11 @@
8892

8993
$app->tpl->setVar('msg', $msg);
9094

95+
//* SET csrf token
96+
$csrf_token = $app->auth->csrf_token_get('ispupdate');
97+
$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']);
98+
$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']);
99+
91100
$app->tpl->setVar($wb);
92101

93102
$app->tpl_defaults();

‎interface/web/admin/remote_action_osupdate.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@
6262
* If the user wants to do the action, write this to our db
6363
*/
6464
if (isset($_POST['server_select'])) {
65+
66+
//* CSRF Check
67+
$app->auth->csrf_token_check();
68+
6569
$server = $_POST['server_select'];
6670
$servers = array();
6771
if ($server == '*') {
@@ -84,6 +88,11 @@
8488

8589
$app->tpl->setVar('msg', $msg);
8690

91+
//* SET csrf token
92+
$csrf_token = $app->auth->csrf_token_get('osupdate');
93+
$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']);
94+
$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']);
95+
8796
$app->tpl->setVar($wb);
8897

8998
$app->tpl_defaults();

‎interface/web/admin/server_config_edit.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,14 @@ function onUpdateSave($sql) {
9393
}
9494
}
9595

96-
$server_config_array[$section] = $app->tform->encode($this->dataRecord, $section);
97-
$server_config_str = $app->ini_parser->get_ini_string($server_config_array);
96+
if($app->tform->errorMessage == '') {
97+
$server_config_array[$section] = $app->tform->encode($this->dataRecord, $section);
98+
$server_config_str = $app->ini_parser->get_ini_string($server_config_array);
9899

99-
$app->db->datalogUpdate('server', array("config" => $server_config_str), 'server_id', $server_id);
100+
$app->db->datalogUpdate('server', array("config" => $server_config_str), 'server_id', $server_id);
101+
} else {
102+
$app->error('Security breach!');
103+
}
100104
}
101105
}
102106

0 commit comments

Comments
 (0)