summaryrefslogtreecommitdiffstats
path: root/application/core/MY_Controller.php
diff options
context:
space:
mode:
authorFlorian Pritz <bluewind@xinu.at>2013-08-29 17:55:52 +0200
committerFlorian Pritz <bluewind@xinu.at>2013-09-02 22:02:27 +0200
commit285262b6c668b4f367f8222880ceb01be39fd3ac (patch)
tree2607d33e77a4ee38970a122eeb5fc4a8f60f9250 /application/core/MY_Controller.php
parent84ce2c6ce0eb1b4f2f32c4ae0d7e08f3571f5018 (diff)
Add CSRF protection
Signed-off-by: Florian Pritz <bluewind@xinu.at>
Diffstat (limited to 'application/core/MY_Controller.php')
-rw-r--r--application/core/MY_Controller.php46
1 files changed, 46 insertions, 0 deletions
diff --git a/application/core/MY_Controller.php b/application/core/MY_Controller.php
index 3ee63424a..09b813b71 100644
--- a/application/core/MY_Controller.php
+++ b/application/core/MY_Controller.php
@@ -19,6 +19,7 @@ class MY_Controller extends CI_Controller {
parent::__construct();
$this->var = new StdClass();
+ $csrf_protection = true;
$this->load->library('migration');
if ( ! $this->migration->current()) {
@@ -41,6 +42,51 @@ class MY_Controller extends CI_Controller {
show_error("Function not JSON enabled");
}
+ if ($this->input->post("apikey") !== false) {
+ /* This relies on the authentication code always verifying the supplied
+ * apikey. If the key is not verified/logged in an attacker could simply
+ * add an empty "apikey" field to the CSRF form to circumvent the
+ * protection. If we always log in if a key is supplied we can ensure
+ * that an attacker (and the victim since they get a cookie) can only
+ * access the attacker's account.
+ */
+ $csrf_protection = false;
+ }
+
+ $uri_start = $this->uri->rsegment(1)."/".$this->uri->rsegment(2);
+ $csrf_whitelisted_handlers = array(
+ "always" => array(
+ /* Whitelist the upload pages because they don't cause harm and a user
+ * might keep the upload page open for more than csrf_expire seconds
+ * and we don't want to annoy them when they upload a big file and the
+ * CSRF check fails.
+ */
+ "file/do_upload",
+ "file/do_paste",
+ ),
+ "cli_client" => array(
+ "file/do_delete",
+ "file/delete",
+ "file/upload_history",
+ ),
+ );
+ if (in_array($uri_start, $csrf_whitelisted_handlers["always"])) {
+ $csrf_protection = false;
+ }
+
+ // TODO: replace cli client with request_type("plain")?
+ if (is_cli_client() && in_array($uri_start, $csrf_whitelisted_handlers["cli_client"])) {
+ $csrf_protection = false;
+ }
+
+ if ($csrf_protection) {
+ // 2 functions for accessing config options, really?
+ $this->config->set_item('csrf_protection', true);
+ config_item("csrf_protection", true);
+ $this->security->__construct();
+ $this->security->csrf_verify();
+ }
+
$this->data['title'] = "FileBin";
}
}