mirror of
https://gitlab.archlinux.org/archlinux/aurweb.git
synced 2025-02-03 10:43:03 +01:00
2c93f0a98f
Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
46 lines
1.5 KiB
PHP
46 lines
1.5 KiB
PHP
<div class="pgbox">
|
|
<?php
|
|
$uid = uid_from_sid($SID);
|
|
while (list($indx, $carr) = each($comments)) { ?>
|
|
<div class="comment-header"><?php
|
|
|
|
if ($SID) {
|
|
$carr['UserName'] = "<a href=\"account.php?Action=AccountInfo&ID={$carr['UsersID']}\">{$carr['UserName']}</a>";
|
|
}
|
|
|
|
$commentHeader = '<p style="display:inline;">' . __('Comment by: %s on %s', $carr['UserName'], gmdate('r', $carr['CommentTS'])) . '</p>';
|
|
|
|
if (canDeleteCommentArray($carr, $atype, $uid)) {
|
|
$durl = '<form method="post" action="packages.php?ID='.$row['ID'].'">';
|
|
$durl.= '<fieldset style="display:inline;">';
|
|
$durl.= '<input type="hidden" name="action" value="do_DeleteComment" />';
|
|
$durl.= '<input type="hidden" name="comment_id" value="'.$carr['ID'].'" />';
|
|
$durl.= '<input type="hidden" name="token" value="'.htmlspecialchars($_COOKIE['AURSID']).'" />';
|
|
$durl.= '<input type="image" src="images/x.png" ';
|
|
$durl.= ' alt="'.__("Delete comment").'" name="submit" value="1" ';
|
|
$durl.= ' /> ';
|
|
$durl.= '</fieldset>';
|
|
|
|
$commentHeader = $durl.$commentHeader."</form>";
|
|
}
|
|
|
|
echo $commentHeader;
|
|
?></div>
|
|
<blockquote class="comment-body">
|
|
<div>
|
|
<?php echo parse_comment($carr['Comments']) ?>
|
|
</div>
|
|
</blockquote>
|
|
<?php
|
|
}
|
|
?>
|
|
</div>
|
|
|
|
<?php
|
|
$count = package_comments_count($_GET['ID']);
|
|
if ($count > 10 && !isset($_GET['comments'])) {
|
|
echo '<div class="pgbox">';
|
|
echo '<a href="'. $_SERVER['REQUEST_URI'] . '&comments=all">'. __('Show all %s comments', $count) . '</a>';
|
|
echo '</div>';
|
|
}
|
|
?>
|