svn: /web/doc-editor/trunk/ index.php js/main.js js/util.js php/AccountManager.php php/controller.php

nbpoole                                  Fri, 24 Jun 2011 03:41:05 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=312427

Log:
Added support for CSRF tokens.

Changed paths:
    U   web/doc-editor/trunk/index.php
    U   web/doc-editor/trunk/js/main.js
    U   web/doc-editor/trunk/js/util.js
    U   web/doc-editor/trunk/php/AccountManager.php
    U   web/doc-editor/trunk/php/controller.php

Modified: web/doc-editor/trunk/index.php
===================================================================
--- web/doc-editor/trunk/index.php	2011-06-24 00:53:52 UTC (rev 312426)
+++ web/doc-editor/trunk/index.php	2011-06-24 03:41:05 UTC (rev 312427)
@@ -80,6 +80,7 @@
 echo cssLoadTemplate('themes/main-all.css');

 echo jsCallTemplate($jsVar);
+echo jsCallTemplate('var csrfToken = "' . $_SESSION['csrfToken'] . '";');

 // ExtJs Javascript core files
 echo jsCallTemplate('document.getElementById("loading-msg").innerHTML = "Loading Core API...";');

Modified: web/doc-editor/trunk/js/main.js
===================================================================
--- web/doc-editor/trunk/js/main.js	2011-06-24 00:53:52 UTC (rev 312426)
+++ web/doc-editor/trunk/js/main.js	2011-06-24 03:41:05 UTC (rev 312427)
@@ -44,6 +44,11 @@
         {
             // We load the configuration for this user
             new ui.task.LoadConfigTask();
+
+            // Set up automatic CSRF token appending for most requests
+            Ext.Ajax.extraParams = { csrfToken: csrfToken };
+            Ext.data.Connection.prototype.extraParams = { csrfToken: csrfToken };
+            Ext.data.ScriptTagProxy.prototype.extraParams = { csrfToken: csrfToken };
         },

         notify : function (type, title, message) {
@@ -731,4 +736,4 @@
     }; // Return
 }();

-Ext.EventManager.onDocumentReady(PhDOE.init, PhDOE, true);
\ No newline at end of file
+Ext.EventManager.onDocumentReady(PhDOE.init, PhDOE, true);

Modified: web/doc-editor/trunk/js/util.js
===================================================================
--- web/doc-editor/trunk/js/util.js	2011-06-24 00:53:52 UTC (rev 312426)
+++ web/doc-editor/trunk/js/util.js	2011-06-24 03:41:05 UTC (rev 312427)
@@ -65,6 +65,7 @@

     config.url = './do/' + config.params.task;
     delete config.params.task;
+    config.params = Ext.applyIf({csrfToken: csrfToken}, config.params);
     config.failure  = config.success = Ext.emptyFn;
     config.callback = function(options, success, response)
     {
@@ -91,4 +92,4 @@
     };

     Ext.Ajax.request(config);
-}
\ No newline at end of file
+}

Modified: web/doc-editor/trunk/php/AccountManager.php
===================================================================
--- web/doc-editor/trunk/php/AccountManager.php	2011-06-24 00:53:52 UTC (rev 312426)
+++ web/doc-editor/trunk/php/AccountManager.php	2011-06-24 03:41:05 UTC (rev 312427)
@@ -301,7 +301,12 @@
            } else {
             $cookieLogin = $_SESSION['vcsLogin'];
            }
-
+
+           // We set up the CSRF token
+           $_SESSION['csrfToken'] = sha1(uniqid(rand(), true));
+
+           // Store some user info in cookies: we can use this to pre-fill the
+           // login page if the user's session expires.
            setcookie("loginApp", $cookieLogin, time() + 3600*24*365, "/"); // One year ;)
            setcookie("email", $email, time() + 3600*24*365, "/");
            setcookie("lang", $this->vcsLang, time() + 3600*24*365, "/");

Modified: web/doc-editor/trunk/php/controller.php
===================================================================
--- web/doc-editor/trunk/php/controller.php	2011-06-24 00:53:52 UTC (rev 312426)
+++ web/doc-editor/trunk/php/controller.php	2011-06-24 03:41:05 UTC (rev 312427)
@@ -14,7 +14,14 @@

 $method     = str_replace('-', '_', $controller->getRequestVariable('task'));

-if (method_exists($controller, $method)) {
+if (isset($_SESSION['csrfToken']) && (!isset($_POST['csrfToken']) || $_POST['csrfToken'] !== $_SESSION['csrfToken'])) {
+    $response = JsonResponseBuilder::failure(
+        array(
+            'msg' => 'CSRF token missing or invalid'
+        )
+    );
+}
+else if (method_exists($controller, $method)) {
     $response = $controller->$method();
 } else {
     $response = JsonResponseBuilder::failure(