having token checks on POST forms

inspirer · Apr 30, 2012 · b84b439 · b84b439
1 parent 1ab3efb
commit b84b439
Show file tree

Hide file tree

Showing 8 changed files with 44 additions and 7 deletions.
diff --git a/src/messenger/webim/libs/common.php b/src/messenger/webim/libs/common.php
@@ -688,4 +688,24 @@ function jspath()
 	return "js/$jsver";
 }
 
-?>
+/* authorization token check for CSRF attack */
+function csrfchecktoken(){
+  if(!isset($_SESSION['csrf_token'])){
+      $_SESSION['csrf_token']=sha1(rand(10000000,99999999));
+    }
+		// check the turing code
+    if ($_SERVER['REQUEST_METHOD'] == 'POST'){
+      //if token match
+      if(!isset($_POST['csrf_token']) || ($_POST['csrf_token'] != $_SESSION['csrf_token'])){
+
+        die("CSRF failure");
+      }
+    }
+}
+
+/* print csrf token as a hidden field*/
+function print_csrf_token_input(){
+  echo "<input name='csrf_token' type='hidden' value='".$_SESSION['csrf_token']."' />";
+}
+
+?>
diff --git a/src/messenger/webim/libs/operator_settings.php b/src/messenger/webim/libs/operator_settings.php
@@ -44,4 +44,4 @@ function setup_operator_settings_tabs($opId, $active)
 	}
 }
 
-?>
+?>
diff --git a/src/messenger/webim/operator/cannededit.php b/src/messenger/webim/operator/cannededit.php
@@ -23,6 +23,8 @@
 require_once('../libs/operator.php');
 require_once('../libs/pagination.php');
 
+csrfchecktoken();
+
 function load_message($key)
 {
 	global $mysqlprefix;
@@ -101,4 +103,4 @@ function add_message($locale, $groupid, $message)
 start_html_output();
 require('../view/cannededit.php');
 exit;
-?>
+?>
diff --git a/src/messenger/webim/operator/operator.php b/src/messenger/webim/operator/operator.php
@@ -23,6 +23,8 @@
 require_once('../libs/operator.php');
 require_once('../libs/operator_settings.php');
 
+csrfchecktoken();
+
 $operator = check_login();
 
 $page = array('opid' => '');

diff --git a/src/messenger/webim/operator/settings.php b/src/messenger/webim/operator/settings.php
@@ -23,6 +23,8 @@
 require_once('../libs/operator.php');
 require_once('../libs/settings.php');
 
+csrfchecktoken();
+
 $operator = check_login();
 
 $page = array('agentId' => '');
@@ -104,4 +106,4 @@
 setup_settings_tabs(0);
 start_html_output();
 require('../view/settings.php');
-?>
+?>
diff --git a/src/messenger/webim/view/agent.php b/src/messenger/webim/view/agent.php
@@ -50,6 +50,10 @@ function tpl_content() { global $page, $webimroot, $errors;
 
 <?php if( $page['opid'] || $page['canmodify'] ) { ?>
 <form name="agentForm" method="post" action="<?php echo $webimroot ?>/operator/operator.php">
+
+<!-- add auth token -->
+<?php print_csrf_token_input() ?>
+
 <input type="hidden" name="opid" value="<?php echo $page['opid'] ?>"/>
 	<div>
 <?php if(!$page['needChangePassword']) { print_tabbar(); } ?>
@@ -130,4 +134,4 @@ function tpl_content() { global $page, $webimroot, $errors;
 } /* content */
 
 require_once('inc_main.php');
-?>
+?>
diff --git a/src/messenger/webim/view/cannededit.php b/src/messenger/webim/view/cannededit.php
@@ -44,6 +44,10 @@ function tpl_content() { global $page, $webimroot, $errors;
 ?>
 
 <form name="cannedForm" method="post" action="<?php echo $webimroot ?>/operator/cannededit.php">
+
+<!-- add auth token -->
+<?php print_csrf_token_input() ?>
+
 <input type="hidden" name="key" value="<?php echo $page['key'] ?>"/>
 <?php if(!$page['key']) { ?>
 <input type="hidden" name="lang" value="<?php echo $page['locale'] ?>"/>
@@ -73,4 +77,4 @@ function tpl_content() { global $page, $webimroot, $errors;
 } /* content */
 
 require_once('inc_main.php');
-?>
+?>
diff --git a/src/messenger/webim/view/settings.php b/src/messenger/webim/view/settings.php
@@ -40,6 +40,9 @@ function tpl_content() { global $page, $webimroot, $errors;
 
 <form name="settings" method="post" action="<?php echo $webimroot ?>/operator/settings.php">
 
+<!-- add auth token -->
+<?php print_csrf_token_input() ?>
+
 	<div>
 <?php print_tabbar(); ?>
 	<div class="mform"><div class="formtop"><div class="formtopi"></div></div><div class="forminner">
@@ -155,4 +158,4 @@ function tpl_content() { global $page, $webimroot, $errors;
 } /* content */
 
 require_once('inc_main.php');
-?>
+?>