Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Various CSRF fixes #4176

Merged
merged 9 commits into from
Aug 12, 2016
Merged

Various CSRF fixes #4176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a4565ca
Fix CSRF in mobile theme
KorvinSzanto Aug 12, 2016
c97e986
Fix CSRF in attribute types
KorvinSzanto Aug 12, 2016
44c6656
Add CSRF protection to conversation points page
KorvinSzanto Aug 12, 2016
e8ef130
Add CSRF to legacy permission file tool
KorvinSzanto Aug 12, 2016
16fa595
Add CSRF token to job uninstall
KorvinSzanto Aug 12, 2016
9398792
Add CSRF tokens to jobs scheduling
KorvinSzanto Aug 12, 2016
833ef75
Add CSRF to system seo bulk page
KorvinSzanto Aug 12, 2016
88ed828
Add CSRF tokens to accessibility page
KorvinSzanto Aug 12, 2016
bd99386
Add CSRF to job reset
KorvinSzanto Aug 12, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
15 changes: 10 additions & 5 deletions web/concrete/controllers/single_page/dashboard/pages/themes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,18 @@ public function view() {
}

public function save_mobile_theme() {
$pt = PageTheme::getByID($this->post('MOBILE_THEME_ID'));
if (is_object($pt)) {
Config::save('concrete.misc.mobile_theme_id', $pt->getThemeID());
if ($this->token->validate('save_mobile_theme')) {
$pt = PageTheme::getByID($this->post('MOBILE_THEME_ID'));
if (is_object($pt)) {
Config::save('concrete.misc.mobile_theme_id', $pt->getThemeID());
} else {
Config::save('concrete.misc.mobile_theme_id', 0);
}
$this->redirect('/dashboard/pages/themes', 'mobile_theme_saved');
} else {
Config::save('concrete.misc.mobile_theme_id', 0);
$this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
$this->view();
}
$this->redirect('/dashboard/pages/themes', 'mobile_theme_saved');
}

public function mobile_theme_saved() {
Expand Down
32 changes: 18 additions & 14 deletions web/concrete/controllers/single_page/dashboard/system/attributes/types.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
use Loader;

class Types extends DashboardPageController {

public function add_attribute_type() {
$pat = PendingType::getByHandle($this->post('atHandle'));
if (is_object($pat)) {
Expand All @@ -19,18 +19,22 @@ public function add_attribute_type() {
}

public function save_attribute_type_associations() {
$list = Category::getList();
foreach($list as $cat) {
$cat->clearAttributeKeyCategoryTypes();
if (is_array($this->post($cat->getAttributeKeyCategoryHandle()))) {
foreach($this->post($cat->getAttributeKeyCategoryHandle()) as $id) {
$type = Type::getByID($id);
$cat->associateAttributeKeyType($type);
}
}
}
if ($this->token->validate('save_attribute_type_associations')) {
$list = Category::getList();
foreach ($list as $cat) {
$cat->clearAttributeKeyCategoryTypes();
if (is_array($this->post($cat->getAttributeKeyCategoryHandle()))) {
foreach ($this->post($cat->getAttributeKeyCategoryHandle()) as $id) {
$type = Type::getByID($id);
$cat->associateAttributeKeyType($type);
}
}
}

$this->redirect('dashboard/system/attributes/types', 'saved', 'associations_updated');
$this->redirect('dashboard/system/attributes/types', 'saved', 'associations_updated');
} else {
$this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
}
}

public function saved($mode = false) {
Expand All @@ -46,5 +50,5 @@ public function saved($mode = false) {
}
}
}
}

}
4 changes: 4 additions & 0 deletions web/concrete/controllers/single_page/dashboard/system/basics/accessibility.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ public function saved()

public function save()
{
if (!$this->token->validate('accessibility')) {
$this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
return $this->view();
}
Config::save('concrete.accessibility.toolbar_titles', !!Request::post('show_titles', false));
Config::save('concrete.accessibility.toolbar_large_font', !!Request::post('increase_font_size', false));
Config::save('concrete.accessibility.display_help_system', !!Request::post('display_help', false));
Expand Down
22 changes: 15 additions & 7 deletions web/concrete/controllers/single_page/dashboard/system/conversations/points.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,22 @@ public function success() {
$this->set('message', t('Rating types updated.'));
}
public function save() {
$db = Loader::db();
foreach (ConversationRatingType::getList() as $crt) {
$rtID = $crt->getConversationRatingTypeID();
$rtPoints = $this->post('rtPoints_' . $rtID);
if (is_string($rtPoints) && is_numeric($rtPoints)) {
$db->Execute('UPDATE ConversationRatingTypes SET cnvRatingTypeCommunityPoints = ? WHERE cnvRatingTypeID = ? LIMIT 1', array($rtPoints, $rtID));

if ($this->token->validate('conversation_points')) {

$db = Loader::db();
foreach (ConversationRatingType::getList() as $crt) {
$rtID = $crt->getConversationRatingTypeID();
$rtPoints = $this->post('rtPoints_' . $rtID);
if (is_string($rtPoints) && is_numeric($rtPoints)) {
$db->Execute('UPDATE ConversationRatingTypes SET cnvRatingTypeCommunityPoints = ? WHERE cnvRatingTypeID = ? LIMIT 1',
array($rtPoints, $rtID));
}
}
$this->redirect('/dashboard/system/conversations/points', 'success');
} else {
$this->error->add(t('Invalid CSRF token. Please refresh and try again.'));
$this->view();
}
$this->redirect('/dashboard/system/conversations/points', 'success');
}
}