summaryrefslogtreecommitdiffstats
path: root/web/html/packages.php
diff options
context:
space:
mode:
authorcanyonknight <canyonknight@gmail.com>2012-06-23 20:40:11 +0200
committerLukas Fleischer <archlinux@cryptocrack.de>2012-06-24 10:59:23 +0200
commit2c93f0a98f0f6380fd07ea17fd16afa2c6e4925b (patch)
treedc5fd78a8cb46cd1475b45eeaa6544fbdeb23280 /web/html/packages.php
parentbfb25807c49d3f35cdce91947a442455e1940392 (diff)
downloadaur-2c93f0a98f0f6380fd07ea17fd16afa2c6e4925b.tar.gz
aur-2c93f0a98f0f6380fd07ea17fd16afa2c6e4925b.tar.xz
Implement token system to fix CSRF vulnerabilities
Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/html/packages.php')
-rw-r--r--web/html/packages.php70
1 files changed, 36 insertions, 34 deletions
diff --git a/web/html/packages.php b/web/html/packages.php
index dc06c7e4..7f31d3d8 100644
--- a/web/html/packages.php
+++ b/web/html/packages.php
@@ -36,46 +36,48 @@ if (isset($_POST['IDs'])) {
# Determine what action to do
$output = "";
-if (current_action("do_Flag")) {
- $output = pkg_flag($atype, $ids, true);
-} elseif (current_action("do_UnFlag")) {
- $output = pkg_flag($atype, $ids, False);
-} elseif (current_action("do_Adopt")) {
- $output = pkg_adopt($atype, $ids, true);
-} elseif (current_action("do_Disown")) {
- $output = pkg_adopt($atype, $ids, False);
-} elseif (current_action("do_Vote")) {
- $output = pkg_vote($atype, $ids, true);
-} elseif (current_action("do_UnVote")) {
- $output = pkg_vote($atype, $ids, False);
-} elseif (current_action("do_Delete")) {
- if (isset($_POST['confirm_Delete'])) {
- if (!isset($_POST['merge_Into']) || empty($_POST['merge_Into'])) {
- $output = pkg_delete($atype, $ids, NULL);
- unset($_GET['ID']);
- }
- else {
- $mergepkgid = pkgid_from_name($_POST['merge_Into']);
- if ($mergepkgid) {
- $output = pkg_delete($atype, $ids, $mergepkgid);
+if (check_token()) {
+ if (current_action("do_Flag")) {
+ $output = pkg_flag($atype, $ids, true);
+ } elseif (current_action("do_UnFlag")) {
+ $output = pkg_flag($atype, $ids, False);
+ } elseif (current_action("do_Adopt")) {
+ $output = pkg_adopt($atype, $ids, true);
+ } elseif (current_action("do_Disown")) {
+ $output = pkg_adopt($atype, $ids, False);
+ } elseif (current_action("do_Vote")) {
+ $output = pkg_vote($atype, $ids, true);
+ } elseif (current_action("do_UnVote")) {
+ $output = pkg_vote($atype, $ids, False);
+ } elseif (current_action("do_Delete")) {
+ if (isset($_POST['confirm_Delete'])) {
+ if (!isset($_POST['merge_Into']) || empty($_POST['merge_Into'])) {
+ $output = pkg_delete($atype, $ids, NULL);
unset($_GET['ID']);
}
else {
- $output = __("Cannot find package to merge votes and comments into.");
+ $mergepkgid = pkgid_from_name($_POST['merge_Into']);
+ if ($mergepkgid) {
+ $output = pkg_delete($atype, $ids, $mergepkgid);
+ unset($_GET['ID']);
+ }
+ else {
+ $output = __("Cannot find package to merge votes and comments into.");
+ }
}
}
+ else {
+ $output = __("The selected packages have not been deleted, check the confirmation checkbox.");
+ }
+ } elseif (current_action("do_Notify")) {
+ $output = pkg_notify($atype, $ids);
+ } elseif (current_action("do_UnNotify")) {
+ $output = pkg_notify($atype, $ids, False);
+ } elseif (current_action("do_DeleteComment")) {
+ $output = pkg_delete_comment($atype);
+ } elseif (current_action("do_ChangeCategory")) {
+ $output = pkg_change_category($atype);
}
- else {
- $output = __("The selected packages have not been deleted, check the confirmation checkbox.");
- }
-} elseif (current_action("do_Notify")) {
- $output = pkg_notify($atype, $ids);
-} elseif (current_action("do_UnNotify")) {
- $output = pkg_notify($atype, $ids, False);
-} elseif (current_action("do_DeleteComment")) {
- $output = pkg_delete_comment($atype);
-} elseif (current_action("do_ChangeCategory")) {
- $output = pkg_change_category($atype);
}
html_header($title);