maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

update csrf initialization

Browse Source 
Signed-off-by: Maurice Preuß (envoyr) <envoyr@froxlor.org>
This commit is contained in:
Maurice Preuß (envoyr)
2022-12-26 14:12:21 +01:00
parent ae4b961ac1
commit 1b63534563
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
lib/init.php
View File

@@ -314,15 +314,20 @@ $mail = new Mailer(true);
// initialize csrf // initialize csrf
if (CurrentUser::hasSession()) { if (CurrentUser::hasSession()) {
$new_token = Froxlor::genSessionId(20); // create new csrf token if not set
UI::twig()->addGlobal('csrf_token', $new_token); if (!$csrf_token = CurrentUser::getField('csrf_token')) {
if ($_SERVER['REQUEST_METHOD'] === 'POST') { $csrf_token = Froxlor::genSessionId(20);
CurrentUser::setField('csrf_token', $csrf_token);
}
// set csrf token for twig
UI::twig()->addGlobal('csrf_token', $csrf_token);
// check if csrf token is valid
if (in_array($_SERVER['REQUEST_METHOD'], ['POST', 'PUT', 'PATCH', 'DELETE'])) {
$current_token = $_POST['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? null; $current_token = $_POST['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? null;
if ($current_token != CurrentUser::getField('csrf_token')) { if ($current_token != CurrentUser::getField('csrf_token')) {
Response::dynamicError('CSRF validation failed'); Response::dynamicError('CSRF validation failed');
} }
} }
CurrentUser::setField('csrf_token', $new_token);
// update cookie lifetime // update cookie lifetime
$cookie_params = [ $cookie_params = [
'expires' => time() + Settings::Get('session.sessiontimeout'), 'expires' => time() + Settings::Get('session.sessiontimeout'),

2
templates/Froxlor/base.html.twig
View File

@@ -7,7 +7,7 @@
<meta name="robots" content="noindex, nofollow, noarchive"/> <meta name="robots" content="noindex, nofollow, noarchive"/>
<meta name="googlebot" content="nosnippet"/> <meta name="googlebot" content="nosnippet"/>
<link rel="icon" type="image/x-icon" href="{{ basehref|default('') }}templates/Froxlor/assets/img/icon.png"> <link rel="icon" type="image/x-icon" href="{{ basehref|default('') }}templates/Froxlor/assets/img/icon.png">
<meta name="csrf-token" content="{{ csrf_token }}" /> {% if csrf_token %}<meta name="csrf-token" content="{{ csrf_token }}" />{% endif %}
<!-- CSS --> <!-- CSS -->
{% if theme_css is empty %} {% if theme_css is empty %}