Allow modules to override CSRF protection.

[tzvetkoff]

Allow modules to override CSRF protection.
Useful for Web APIs and all other kinds of things.

API changes:
- Added public CHTTPSock::GetURI() method
- Added public CModule::ValidateWebRequestCSRFCheck() method
- Made CWebSock::GetCSRFCheck() method public so it can be accessed
from CModule
- Added public CWebSock::ValidateCSRFCheck() method

Other changes:
- Added a Sample Web API module (modules/samplewebapi.cpp) and a
simple web form with no CSRF check.

Implements feature request #1180.

[coveralls]

Coverage decreased (-0.03%) to 40.058% when pulling eec19f6 on tzvetkoff:module_csrf_override into 56620af on znc:master.

[lol768]

Cheers @tzvetkoff

[DarthGandalf]

This comment becomes outdated.

[DarthGandalf]

Please add some tests.

I don't quite understand why existing WebRequiresLogin() is not enough. Shouldn't that function be used to disable protection?
I know that currently that doesn't work. I'm talking about the proposed API changes.

[lol768]

@DarthGandalf

I don't quite understand why existing WebRequiresLogin() is not enough. Shouldn't that function be used to disable protection?

I can still think of use-cases where I want to require cookie-based auth but not require a CSRF token. For example, a JSON-based API used with frontend JavaScript. CSRF isn't necessarily a worry if a Content-Type of application/x-www-form-urlencoded isn't accepted since a form is only going to send data using that content type - and without CORS, the same-origin policy will prevent other-origin requests to the same API.

In this circumstance, requiring a CSRF value to be submitted is just additional hassle.

---

Let's not conflate authentication and cross-site request forgery tokens. There are cases (e.g. a "contact us" form) where it's perfectly reasonable for a developer to want to apply a CSRF token to prevent other users from being made to submit spam via the contact form from another site. This is completely independent of any form of authentication mechanism.

[DarthGandalf]

Yes, that's a good example, thanks.

[lol768]

@DarthGandalf @tzvetkoff I've updated this PR against the latest master, clarified some of the source code comments and added an integration test.

https://github.com/lol768/znc/commits/module_csrf_override

What's the best way forward, can you merge my commits in @tzvetkoff?

[DarthGandalf]

@lol768 you can create PR yourself if @tzvetkoff doesn't merge your commits to this PR.

[lol768]

Cheers @DarthGandalf, will do so if the commits aren't added in a few days.

@tzvetkoff If I do end up adding my own PR, I'll split the bounty amount on work done and PayPal you the bigger share of it.

[lol768]

PR added to #1327