[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Use url-safe base64 encoding/decoding on cookies to prevent modsecurity false positives

Benoit Grégoire pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
da3ee0fe by Michel Ram at 2026-08-05T16:03:29+00:00
[FIX] Use url-safe base64 encoding/decoding on cookies to prevent modsecurity false positives
---
* [FIX] Use url-safe base64 encoding on CSRF Token cookie to prevent false positives for modsecurity rule 941120.

* [FIX] Use url-safe base64 encoding on extra cookie to prevent false positives for modsecurity rule 941120.

See merge request tikiwiki/tiki!10836

- - - - -


2 changed files:

- lib/tikiaccesslib.php
- tiki-setup_base.php


Changes:

=====================================
lib/tikiaccesslib.php
=====================================
@@ -365,7 +365,10 @@ class TikiAccessLib extends TikiLib
         $key = str_pad(substr($key, 0, SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES), SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES);
         $nonce = random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);
 
-        return base64_encode($nonce . sodium_crypto_aead_xchacha20poly1305_ietf_encrypt($value, '', $nonce, $key));
+        # Perform url-safe base64 encoding.
+        $encoded = base64_encode($nonce . sodium_crypto_aead_xchacha20poly1305_ietf_encrypt($value, '', $nonce, $key));
+        $urlsafe = str_replace(['+', '/', '='], ['-', '_', ''], $encoded);
+        return $urlsafe;
     }
 
     /**
@@ -377,7 +380,15 @@ class TikiAccessLib extends TikiLib
     {
         $key = TikiLib::lib('tiki')->get_site_hash();
         $key = str_pad(substr($key, 0, SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES), SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_KEYBYTES);
+
+        # Perform url-safe base64 decoding.
+        $value = str_replace(['-', '_'], ['+', '/'], $value);
+        $mod4 = strlen($value) % 4;
+        if ($mod4) {
+            $value .= substr('====', $mod4);
+        }
         $value = base64_decode($value);
+
         $nonce = substr($value, 0, SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);
         $cipherText = substr($value, SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);
 


=====================================
tiki-setup_base.php
=====================================
@@ -294,7 +294,7 @@ if (isset($_SERVER["REQUEST_URI"]) && ! str_contains($_SERVER['REQUEST_URI'], 't
                         exit;
                     }
                 } else {
-                    $sequence = $tikilib->generate_unique_sequence(16);
+                    $sequence = $tikilib->generate_unique_sequence(16, true);
                     $_SESSION['extra_validation'] = $sequence;
                     setcookie($extra_cookie_name, $sequence, [
                         'expires' => time() + 365 * 24 * 3600,



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/da3ee0fe7eced69023bb33b5f900a0f58098435a

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/da3ee0fe7eced69023bb33b5f900a0f58098435a
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs