From 2c93f0a98f0f6380fd07ea17fd16afa2c6e4925b Mon Sep 17 00:00:00 2001 From: canyonknight Date: Sat, 23 Jun 2012 14:40:11 -0400 Subject: Implement token system to fix CSRF vulnerabilities Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer --- web/lib/acctfuncs.inc.php | 1 + web/lib/aur.inc.php | 10 ++++++++++ 2 files changed, 11 insertions(+) (limited to 'web/lib') diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 9bd6e51..51078b8 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -33,6 +33,7 @@ function display_account_form($UTYPE,$A,$U="",$T="",$S="", print "\n"; if ($UID) { print "\n"; + print "\n"; } print ""; print "\n"; diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 6bc36ac..8b9f31e 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -77,6 +77,16 @@ function check_sid($dbh=NULL) { return; } +# Verify the supplied token matches the expected token for POST forms +# +function check_token() { + if (isset($_POST['token'])) { + return ($_POST['token'] == $_COOKIE['AURSID']); + } else { + return false; + } +} + # verify that an email address looks like it is legitimate # function valid_email($addy) { -- cgit v1.2.3-70-g09d2