iarv/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-03-28 17:42:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Webmods: Only accept POST requests with a secret parameter

Browse Source 
This is a first step against CSRF. Thanks to flakes for the idea.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1932 726aef4b-f618-498e-8847-2d620e286838
This commit is contained in:
psychon
2010-04-25 13:04:51 +00:00
parent eaaddf01bb
commit b0d140e2ed
4 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
WebModules.cpp
View File

@@ -518,6 +518,16 @@ void CWebSock::OnPageRequest(const CString& sURI) {
}
CWebSock::EPageReqResult CWebSock::OnPageRequestInternal(const CString& sURI, CString& sPageRet) {
// Check that they really POSTed from one our forms by checking if they
// know the "secret" CSRF check value. Don't do this for login since
// CSRF against the login form makes no sense and the login form does a
// cookies-enabled check which would break otherwise.
if (IsPost() && GetParam("_CSRF_Check") != GetCSRFCheck() && sURI != "/login") {
sPageRet = GetErrorPage(403, "Access denied", "POST requests need to send "
"a secret token to prevent cross-site request forgery attacks.");
return PAGE_PRINT;
}
SendCookie("SessionId", GetSession()->GetId());
if (GetSession()->IsLoggedIn()) {
@@ -714,6 +724,11 @@ CSmartPtr<CWebSession> CWebSock::GetSession() {
return spSession;
}
CString CWebSock::GetCSRFCheck() {
CSmartPtr<CWebSession> pSession = GetSession();
return pSession->GetId().MD5();
}
bool CWebSock::OnLogin(const CString& sUser, const CString& sPass) {
DEBUG("=================== CWebSock::OnLogin()");
m_spAuth = new CWebAuth(this, sUser, sPass);