mirror of
https://gitlab.archlinux.org/archlinux/aurweb.git
synced 2025-02-03 10:43:03 +01:00
2c93f0a98f
Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
66 lines
2.4 KiB
PHP
66 lines
2.4 KiB
PHP
<div class="pgbox">
|
|
<form action="packages.php?ID=<?php echo $row['ID'] ?>" method="post">
|
|
<fieldset>
|
|
<input type='hidden' name='IDs[<?php echo $row['ID'] ?>]' value='1' />
|
|
<input type='hidden' name='ID' value="<?php echo $row['ID'] ?>" />
|
|
<input type='hidden' name='token' value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
|
|
<?php
|
|
# Voting Button
|
|
#
|
|
$q = "SELECT * FROM PackageVotes WHERE UsersID = ". $uid;
|
|
$q.= " AND PackageID = ".$row["ID"];
|
|
$result = db_query($q, $dbh);
|
|
if ($result) {
|
|
if (!mysql_num_rows($result)) {
|
|
echo " <input type='submit' class='button' name='do_Vote'";
|
|
echo " value='".__("Vote")."' /> ";
|
|
} else {
|
|
echo "<input type='submit' class='button' name='do_UnVote'";
|
|
echo " value='".__("UnVote")."' /> ";
|
|
}
|
|
}
|
|
|
|
# Comment Notify Button
|
|
#
|
|
$q = "SELECT * FROM CommentNotify WHERE UserID = ". $uid;
|
|
$q.= " AND PkgID = ".$row["ID"];
|
|
$result = db_query($q, $dbh);
|
|
if ($result) {
|
|
if (!mysql_num_rows($result)) {
|
|
echo "<input type='submit' class='button' name='do_Notify'";
|
|
echo " value='".__("Notify")."' title='".__("New Comment Notification")."' /> ";
|
|
} else {
|
|
echo "<input type='submit' class='button' name='do_UnNotify'";
|
|
echo " value='".__("UnNotify")."' title='".__("No New Comment Notification")."' /> ";
|
|
}
|
|
}
|
|
|
|
if ($row["OutOfDateTS"] === NULL) {
|
|
echo "<input type='submit' class='button' name='do_Flag'";
|
|
echo " value='".__("Flag Out-of-date")."' />\n";
|
|
} else {
|
|
echo "<input type='submit' class='button' name='do_UnFlag'";
|
|
echo " value='".__("UnFlag Out-of-date")."' />\n";
|
|
}
|
|
|
|
if ($row["MaintainerUID"] === NULL) {
|
|
echo "<input type='submit' class='button' name='do_Adopt'";
|
|
echo " value='".__("Adopt Packages")."' />\n";
|
|
} else if ($uid == $row["MaintainerUID"] ||
|
|
$atype == "Trusted User" || $atype == "Developer") {
|
|
echo "<input type='submit' class='button' name='do_Disown'";
|
|
echo " value='".__("Disown Packages")."' />\n";
|
|
}
|
|
|
|
if ($atype == "Trusted User" || $atype == "Developer") {
|
|
echo "<input type='submit' class='button' name='do_Delete'";
|
|
echo " value='".__("Delete Packages")."' />\n";
|
|
echo "<label for='merge_Into'>".__("Merge into")."</label>\n";
|
|
echo "<input type='text' id='merge_Into' name='merge_Into' /> ";
|
|
echo "<input type='checkbox' name='confirm_Delete' value='1' /> ";
|
|
echo __("Confirm")."\n";
|
|
}
|
|
?>
|
|
</fieldset>
|
|
</form>
|
|
</div>
|