lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-13 08:09:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

legacy/csrf - move csrf check code from d1962f8ed5 into legacy scope.

Browse Source 
The original intend was to be able to reuse the Csrf class, but as this requires direct access to the session object, it's likely not a good idea for the goals of https://github.com/opnsense/core/issues/6389
Since the legacy pages need a lock on session anyway,  keeping it doesn't make a difference.
This commit is contained in:
Ad Schellevis 2024-05-07 11:08:55 +02:00
parent 24f36bf332
commit 56b3a44d5f
3 changed files with 27 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
plist
View File

@ -510,7 +510,6 @@
/usr/local/opnsense/mvc/app/library/OPNsense/Core/Backend.php
/usr/local/opnsense/mvc/app/library/OPNsense/Core/Config.php
/usr/local/opnsense/mvc/app/library/OPNsense/Core/ConfigException.php
/usr/local/opnsense/mvc/app/library/OPNsense/Core/Csrf.php
/usr/local/opnsense/mvc/app/library/OPNsense/Core/File.php
/usr/local/opnsense/mvc/app/library/OPNsense/Core/FileObject.php
/usr/local/opnsense/mvc/app/library/OPNsense/Core/Routing.php

58
src/opnsense/mvc/app/library/OPNsense/Core/Csrf.php
View File

@ -1,58 +0,0 @@
<?php
/*
* Copyright (C) 2024 Deciso B.V.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
namespace OPNsense\Core;
class Csrf
{
/**
* Generate a random URL-safe base64 string.
* Usable base64 characters according to https://www.ietf.org/rfc/rfc3548.txt
*/
public function base64Safe($len = 16)
{
return rtrim(strtr(base64_encode(random_bytes($len)), "+/", "-_"), '=');
}
public function getToken()
{
// only request new token when session has none
if (session_status() == PHP_SESSION_NONE) {
// our session is not guaranteed to be started at this point.
session_start();
}
if (empty($_SESSION['$PHALCON/CSRF/KEY$']) || empty($_SESSION['$PHALCON/CSRF$'])) {
$_SESSION['$PHALCON/CSRF$'] = $this->base64Safe(16);
$_SESSION['$PHALCON/CSRF/KEY$'] = $this->base64Safe(16);
}
return [
'token' => $_SESSION['$PHALCON/CSRF$'],
'key' => $_SESSION['$PHALCON/CSRF/KEY$']
];
}
}

31
src/www/csrf.inc
View File

@ -28,9 +28,6 @@
class LegacyCSRF
{
private $di = null;
private $security = null;
private $session = null;
private $is_html_output = false;
public function __construct()
{
@ -53,6 +50,32 @@ class LegacyCSRF
ob_start(array($this,'csrfRewriteHandler'), 5242880);
}
/**
* Generate a random URL-safe base64 string.
* Usable base64 characters according to https://www.ietf.org/rfc/rfc3548.txt
*/
public function base64Safe($len = 16)
{
return rtrim(strtr(base64_encode(random_bytes($len)), "+/", "-_"), '=');
}
public function getToken()
{
// only request new token when session has none
if (session_status() == PHP_SESSION_NONE) {
// our session is not guaranteed to be started at this point.
session_start();
}
if (empty($_SESSION['$PHALCON/CSRF/KEY$']) || empty($_SESSION['$PHALCON/CSRF$'])) {
$_SESSION['$PHALCON/CSRF$'] = $this->base64Safe(16);
$_SESSION['$PHALCON/CSRF/KEY$'] = $this->base64Safe(16);
}
return [
'token' => $_SESSION['$PHALCON/CSRF$'],
'key' => $_SESSION['$PHALCON/CSRF/KEY$']
];
}
public function checkToken()
{
$result = false; // default, not valid
@ -76,7 +99,7 @@ class LegacyCSRF
$this->is_html_output = true;
}
if ($this->is_html_output) {
$csrf = (new OPNsense\Core\Csrf())->getToken();
$csrf = $this->getToken();
$inputtag = "<input type=\"hidden\" name=\"{$csrf['key']}\" value=\"{$csrf['token']}\" autocomplete=\"new-password\" />";
$buffer = preg_replace('#(<form[^>]*method\s*=\s*["\']post["\'][^>]*>)#i', '$1' . $inputtag, $buffer);
// csrf token for Ajax type requests