mirror of
https://github.com/slawkens/myaac.git
synced 2025-10-14 09:44:55 +02:00
CSRF Protection (#235)
* Fix alert class name * feature: csrf protection * Cosmetics * Fix token generate * Admin Panel: changelogs csrf protection * news/id route * Refactor admin newses + add csrf * Use admin.links instead * Admin panel: Pages csrf * Menus: better csrf + add success message on reset colors * Plugins csrf * Move definitions * add info function, same as note($message) * Update mailer.php * Fix new page/news links * clear_cache & maintenance csrf * Formatting * Fix news type * Fix changelog link * Add new changelog link * More info to confirm dialog * This is always true
This commit is contained in:
Slawomir Boczek
134
system/src/Admin/Pages.php
Normal file
134
system/src/Admin/Pages.php
Normal file
@@ -0,0 +1,134 @@
|
||||
<?php
|
||||
namespace MyAAC\Admin;
|
||||
|
||||
use MyAAC\Models\Pages as ModelsPages;
|
||||
|
||||
class Pages
|
||||
{
|
||||
static public function verify($name, $title, $body, $player_id, $php, $enable_tinymce, $access, &$errors)
|
||||
{
|
||||
if(!isset($title[0]) || !isset($body[0])) {
|
||||
$errors[] = 'Please fill all inputs.';
|
||||
return false;
|
||||
}
|
||||
if(strlen($name) > PAGE_NAME_LIMIT) {
|
||||
$errors[] = 'Page name cannot be longer than ' . PAGE_NAME_LIMIT . ' characters.';
|
||||
return false;
|
||||
}
|
||||
if(strlen($title) > PAGE_TITLE_LIMIT) {
|
||||
$errors[] = 'Page title cannot be longer than ' . PAGE_TITLE_LIMIT . ' characters.';
|
||||
return false;
|
||||
}
|
||||
if(strlen($body) > PAGE_BODY_LIMIT) {
|
||||
$errors[] = 'Page content cannot be longer than ' . PAGE_BODY_LIMIT . ' characters.';
|
||||
return false;
|
||||
}
|
||||
if(!isset($player_id) || $player_id == 0) {
|
||||
$errors[] = 'Player ID is wrong.';
|
||||
return false;
|
||||
}
|
||||
if(!isset($php) || ($php != 0 && $php != 1)) {
|
||||
$errors[] = 'Enable PHP is wrong.';
|
||||
return false;
|
||||
}
|
||||
if ($php == 1 && !getBoolean(setting('core.admin_pages_php_enable'))) {
|
||||
$errors[] = 'PHP pages disabled on this server. To enable go to Settings in Admin Panel and enable <strong>Enable PHP Pages</strong>.';
|
||||
return false;
|
||||
}
|
||||
if(!isset($enable_tinymce) || ($enable_tinymce != 0 && $enable_tinymce != 1)) {
|
||||
$errors[] = 'Enable TinyMCE is wrong.';
|
||||
return false;
|
||||
}
|
||||
if(!isset($access) || $access < 0 || $access > PHP_INT_MAX) {
|
||||
$errors[] = 'Access is wrong.';
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
static public function get($id)
|
||||
{
|
||||
$row = ModelsPages::find($id);
|
||||
if ($row) {
|
||||
return $row->toArray();
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
static public function add($name, $title, $body, $player_id, $php, $enable_tinymce, $access, &$errors)
|
||||
{
|
||||
if(!self::verify($name, $title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!ModelsPages::where('name', $name)->exists())
|
||||
ModelsPages::create([
|
||||
'name' => $name,
|
||||
'title' => $title,
|
||||
'body' => $body,
|
||||
'player_id' => $player_id,
|
||||
'php' => $php ? '1' : '0',
|
||||
'enable_tinymce' => $enable_tinymce ? '1' : '0',
|
||||
'access' => $access
|
||||
]);
|
||||
else
|
||||
$errors[] = 'Page with this link already exists.';
|
||||
|
||||
return !count($errors);
|
||||
}
|
||||
|
||||
static public function update($id, $name, $title, $body, $player_id, $php, $enable_tinymce, $access, &$errors)
|
||||
{
|
||||
if(!self::verify($name, $title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
ModelsPages::where('id', $id)->update([
|
||||
'name' => $name,
|
||||
'title' => $title,
|
||||
'body' => $body,
|
||||
'player_id' => $player_id,
|
||||
'php' => $php ? '1' : '0',
|
||||
'enable_tinymce' => $enable_tinymce ? '1' : '0',
|
||||
'access' => $access
|
||||
]);
|
||||
return true;
|
||||
}
|
||||
|
||||
static public function delete($id, &$errors)
|
||||
{
|
||||
if (isset($id)) {
|
||||
$row = ModelsPages::find($id);
|
||||
if ($row) {
|
||||
$row->delete();
|
||||
}
|
||||
else
|
||||
$errors[] = 'Page with id ' . $id . ' does not exists.';
|
||||
} else
|
||||
$errors[] = 'id not set';
|
||||
|
||||
return !count($errors);
|
||||
}
|
||||
|
||||
static public function toggleHidden($id, &$errors, &$status)
|
||||
{
|
||||
if (isset($id)) {
|
||||
$row = ModelsPages::find($id);
|
||||
if ($row) {
|
||||
$row->hidden = $row->hidden == 1 ? 0 : 1;
|
||||
if (!$row->save()) {
|
||||
$errors[] = 'Fail during toggle hidden Page.';
|
||||
}
|
||||
$status = $row->hidden;
|
||||
}
|
||||
else {
|
||||
$errors[] = 'Page with id ' . $id . ' does not exists.';
|
||||
}
|
||||
} else
|
||||
$errors[] = 'id not set';
|
||||
|
||||
return !count($errors);
|
||||
}
|
||||
}
|
||||
95
system/src/CsrfToken.php
Normal file
95
system/src/CsrfToken.php
Normal file
@@ -0,0 +1,95 @@
|
||||
<?php
|
||||
/**
|
||||
* CsrfToken
|
||||
*
|
||||
* @package MyAAC
|
||||
* @author Znote
|
||||
* @author Slawkens <slawkens@gmail.com>
|
||||
* @copyright 2023 MyAAC
|
||||
* @link https://my-aac.org
|
||||
*/
|
||||
|
||||
namespace MyAAC;
|
||||
|
||||
class CsrfToken
|
||||
{
|
||||
public static function generate(): void
|
||||
{
|
||||
$token = sha1(uniqid(time(), true));
|
||||
|
||||
setSession('csrf_token', $token);
|
||||
}
|
||||
|
||||
/**
|
||||
* Displays a random token to prevent CSRF attacks.
|
||||
*
|
||||
* @access public
|
||||
* @static true
|
||||
* @return void
|
||||
**/
|
||||
public static function create(): void {
|
||||
echo '<input type="hidden" name="csrf_token" value="' . self::get() . '" />';
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the active token, if there is one.
|
||||
*
|
||||
* @access public
|
||||
* @static true
|
||||
* @return mixed
|
||||
**/
|
||||
public static function get(): mixed
|
||||
{
|
||||
$token = getSession('csrf_token');
|
||||
return $token ?? false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates whether the active token is valid or not.
|
||||
*
|
||||
* @param string $post
|
||||
* @access public
|
||||
* @static true
|
||||
* @return boolean
|
||||
**/
|
||||
public static function isValid($post): bool
|
||||
{
|
||||
if (!setting('core.csrf_protection')) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Token doesn't exist yet, return false.
|
||||
if (!self::get()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return ($post == getSession('csrf_token'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Destroys the active token.
|
||||
*
|
||||
* @access protected
|
||||
* @static true
|
||||
* @return void
|
||||
**/
|
||||
protected static function reset(): void {
|
||||
unsetSession('csrf_token');
|
||||
}
|
||||
|
||||
/**
|
||||
* Displays information on both the post token and the session token.
|
||||
*
|
||||
* @param string $post
|
||||
* @access public
|
||||
* @static true
|
||||
* @return void
|
||||
**/
|
||||
public static function debug($post): void
|
||||
{
|
||||
echo '<pre>', var_export([
|
||||
'post' => $post,
|
||||
'token' => self::get()
|
||||
], true), '</pre>';
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user