From 9ddefa979a12aff2334d6e7048e142cfdef5bb89 Mon Sep 17 00:00:00 2001 From: Frédéric Guillot Date: Mon, 29 Jan 2018 15:56:30 -0800 Subject: Add CSRF check for task and project files upload --- app/Controller/BaseController.php | 7 ++++++ app/Controller/ProjectFileController.php | 1 + app/Controller/TaskFileController.php | 1 + app/Core/Http/Request.php | 11 +++++++++ app/Core/Security/Token.php | 42 ++++++++++++++++++++++++++------ app/Helper/AppHelper.php | 5 ++++ app/Template/project_file/create.php | 1 + app/Template/task_file/create.php | 1 + assets/js/app.min.js | 4 +-- assets/js/components/file-upload.js | 4 +-- assets/js/core/http.js | 3 ++- vendor/composer/autoload_classmap.php | 2 ++ vendor/composer/autoload_static.php | 2 ++ 13 files changed, 71 insertions(+), 13 deletions(-) diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php index 43ecfaab..1433ec14 100644 --- a/app/Controller/BaseController.php +++ b/app/Controller/BaseController.php @@ -26,6 +26,13 @@ abstract class BaseController extends Base } } + protected function checkReusableCSRFParam() + { + if (! $this->token->validateReusableCSRFToken($this->request->getRawValue('csrf_token'))) { + throw new AccessForbiddenException(); + } + } + /** * Check webhook token * diff --git a/app/Controller/ProjectFileController.php b/app/Controller/ProjectFileController.php index 83c7779f..a3e23f04 100644 --- a/app/Controller/ProjectFileController.php +++ b/app/Controller/ProjectFileController.php @@ -32,6 +32,7 @@ class ProjectFileController extends BaseController */ public function save() { + $this->checkReusableCSRFParam(); $project = $this->getProject(); $result = $this->projectFileModel->uploadFiles($project['id'], $this->request->getFileInfo('files')); diff --git a/app/Controller/TaskFileController.php b/app/Controller/TaskFileController.php index ff0c299e..4c489238 100644 --- a/app/Controller/TaskFileController.php +++ b/app/Controller/TaskFileController.php @@ -51,6 +51,7 @@ class TaskFileController extends BaseController */ public function save() { + $this->checkReusableCSRFParam(); $task = $this->getTask(); $result = $this->taskFileModel->uploadFiles($task['id'], $this->request->getFileInfo('files')); diff --git a/app/Core/Http/Request.php b/app/Core/Http/Request.php index 44bfdbe6..f7d29ab9 100644 --- a/app/Core/Http/Request.php +++ b/app/Core/Http/Request.php @@ -111,6 +111,17 @@ class Request extends Base return array(); } + /** + * Get POST value without modification + * + * @param $name + * @return mixed|null + */ + public function getRawValue($name) + { + return isset($this->post[$name]) ? $this->post[$name] : null; + } + /** * Get the raw body of the HTTP request * diff --git a/app/Core/Security/Token.php b/app/Core/Security/Token.php index 9b0c5769..5efc6201 100644 --- a/app/Core/Security/Token.php +++ b/app/Core/Security/Token.php @@ -25,21 +25,25 @@ class Token extends Base } /** - * Generate and store a CSRF token in the current session + * Generate and store a one-time CSRF token * * @access public * @return string Random token */ public function getCSRFToken() { - if (! session_exists('csrf')) { - session_set('csrf', []); - } - - $nonce = self::getToken(); - session_merge('csrf', [$nonce => true]); + return $this->createSessionToken('csrf'); + } - return $nonce; + /** + * Generate and store a reusable CSRF token + * + * @access public + * @return string + */ + public function getReusableCSRFToken() + { + return $this->createSessionToken('pcsrf'); } /** @@ -60,4 +64,26 @@ class Token extends Base return false; } + + public function validateReusableCSRFToken($token) + { + $tokens = session_get('pcsrf'); + if (isset($tokens[$token])) { + return true; + } + + return false; + } + + protected function createSessionToken($key) + { + if (! session_exists($key)) { + session_set($key, []); + } + + $nonce = self::getToken(); + session_merge($key, [$nonce => true]); + + return $nonce; + } } diff --git a/app/Helper/AppHelper.php b/app/Helper/AppHelper.php index 3cefd1c5..3a0a2428 100644 --- a/app/Helper/AppHelper.php +++ b/app/Helper/AppHelper.php @@ -12,6 +12,11 @@ use Kanboard\Core\Base; */ class AppHelper extends Base { + public function getToken() + { + return $this->token; + } + public function isAjax() { return $this->request->isAjax(); diff --git a/app/Template/project_file/create.php b/app/Template/project_file/create.php index de35f87c..74c5fa70 100644 --- a/app/Template/project_file/create.php +++ b/app/Template/project_file/create.php @@ -3,6 +3,7 @@ app->component('file-upload', array( + 'csrf' => $this->app->getToken()->getReusableCSRFToken(), 'maxSize' => $max_size, 'url' => $this->url->to('ProjectFileController', 'save', array('project_id' => $project['id'])), 'labelDropzone' => t('Drag and drop your files here'), diff --git a/app/Template/task_file/create.php b/app/Template/task_file/create.php index eebb08eb..46fc7d66 100644 --- a/app/Template/task_file/create.php +++ b/app/Template/task_file/create.php @@ -3,6 +3,7 @@ app->component('file-upload', array( + 'csrf' => $this->app->getToken()->getReusableCSRFToken(), 'maxSize' => $max_size, 'url' => $this->url->to('TaskFileController', 'save', array('task_id' => $task['id'], 'project_id' => $task['project_id'])), 'labelDropzone' => t('Drag and drop your files here'), diff --git a/assets/js/app.min.js b/assets/js/app.min.js index ca7b55c7..bf0243ed 100644 --- a/assets/js/app.min.js +++ b/assets/js/app.min.js @@ -1,2 +1,2 @@ -!function(){function e(e,a,i){if(!o)throw new Error("textarea-caret-position#getCaretCoordinates should only be called in a browser");var r=i&&i.debug||!1;if(r){var d=document.querySelector("#input-textarea-caret-position-mirror-div");d&&d.parentNode.removeChild(d)}var s=document.createElement("div");s.id="input-textarea-caret-position-mirror-div",document.body.appendChild(s);var l=s.style,c=window.getComputedStyle?getComputedStyle(e):e.currentStyle;l.whiteSpace="pre-wrap","INPUT"!==e.nodeName&&(l.wordWrap="break-word"),l.position="absolute",r||(l.visibility="hidden"),t.forEach(function(e){l[e]=c[e]}),n?e.scrollHeight>parseInt(c.height)&&(l.overflowY="scroll"):l.overflow="hidden",s.textContent=e.value.substring(0,a),"INPUT"===e.nodeName&&(s.textContent=s.textContent.replace(/\s/g," "));var u=document.createElement("span");u.textContent=e.value.substring(a)||".",s.appendChild(u);var m={top:u.offsetTop+parseInt(c.borderTopWidth),left:u.offsetLeft+parseInt(c.borderLeftWidth)};return r?u.style.backgroundColor="#aaa":document.body.removeChild(s),m}var t=["direction","boxSizing","width","height","overflowX","overflowY","borderTopWidth","borderRightWidth","borderBottomWidth","borderLeftWidth","borderStyle","paddingTop","paddingRight","paddingBottom","paddingLeft","fontStyle","fontVariant","fontWeight","fontStretch","fontSize","fontSizeAdjust","lineHeight","fontFamily","textAlign","textTransform","textIndent","textDecoration","letterSpacing","wordSpacing","tabSize","MozTabSize"],o="undefined"!=typeof window,n=o&&null!=window.mozInnerScreenX;"undefined"!=typeof module&&void 0!==module.exports?module.exports=e:o&&(window.getCaretCoordinates=e)}(),function(){function e(){if(!("KeyboardEvent"in window)||"key"in KeyboardEvent.prototype)return!1;var e={get:function(e){var t=o.keys[this.which||this.keyCode];return Array.isArray(t)&&(t=t[+this.shiftKey]),t}};return Object.defineProperty(KeyboardEvent.prototype,"key",e),e}var t,o={polyfill:e,keys:{3:"Cancel",6:"Help",8:"Backspace",9:"Tab",12:"Clear",13:"Enter",16:"Shift",17:"Control",18:"Alt",19:"Pause",20:"CapsLock",27:"Escape",28:"Convert",29:"NonConvert",30:"Accept",31:"ModeChange",32:" ",33:"PageUp",34:"PageDown",35:"End",36:"Home",37:"ArrowLeft",38:"ArrowUp",39:"ArrowRight",40:"ArrowDown",41:"Select",42:"Print",43:"Execute",44:"PrintScreen",45:"Insert",46:"Delete",48:["0",")"],49:["1","!"],50:["2","@"],51:["3","#"],52:["4","$"],53:["5","%"],54:["6","^"],55:["7","&"],56:["8","*"],57:["9","("],91:"OS",93:"ContextMenu",144:"NumLock",145:"ScrollLock",181:"VolumeMute",182:"VolumeDown",183:"VolumeUp",186:[";",":"],187:["=","+"],188:[",","<"],189:["-","_"],190:[".",">"],191:["/","?"],192:["`","~"],219:["[","{"],220:["\\","|"],221:["]","}"],222:["'",'"'],224:"Meta",225:"AltGraph",246:"Attn",247:"CrSel",248:"ExSel",249:"EraseEof",250:"Play",251:"ZoomOut"}};for(t=1;t<25;t++)o.keys[111+t]="F"+t;var n="";for(t=65;t<91;t++)n=String.fromCharCode(t),o.keys[t]=[n.toLowerCase(),n.toUpperCase()];o.polyfill()}(),Element.prototype.matches||(Element.prototype.matches=Element.prototype.matchesSelector||Element.prototype.mozMatchesSelector||Element.prototype.msMatchesSelector||Element.prototype.oMatchesSelector||Element.prototype.webkitMatchesSelector||function(e){for(var t=(this.document||this.ownerDocument).querySelectorAll(e),o=t.length;--o>=0&&t.item(o)!==this;);return o>-1});var KB={components:{},utils:{},html:{},http:{},listeners:{clicks:{},changes:{},keys:[],internals:{}}};KB.on=function(e,t){this.listeners.internals.hasOwnProperty(e)||(this.listeners.internals[e]=[]),this.listeners.internals[e].push(t)},KB.trigger=function(e,t){if(this.listeners.internals.hasOwnProperty(e))for(var o=0;o0){for(var i=!0,r=0;r-1)window.location=t.split("#")[0];else if(t)window.location=t;else if(o)window.location=o;else if("application/json"===e.getResponseHeader("Content-Type"))try{return JSON.parse(e.responseText)}catch(e){}return e.responseText}var i=function(){},r=function(){};this.execute=function(){var d=new XMLHttpRequest;d.open(e,t,!0),d.setRequestHeader("X-Requested-With","XMLHttpRequest");for(var s in o)o.hasOwnProperty(s)&&d.setRequestHeader(s,o[s]);return d.onerror=function(){r()},d.onreadystatechange=function(){if(d.readyState===XMLHttpRequest.DONE){var e=a(d);200===d.status?i(e):r(e)}},d.send(n),this},this.success=function(e){return i=e,this},this.error=function(e){return r=e,this}},KB.http.get=function(e){return new KB.http.request("GET",e).execute()},KB.http.postJson=function(e,t){var o={"Content-Type":"application/json",Accept:"application/json"};return new KB.http.request("POST",e,o,JSON.stringify(t)).execute()},KB.http.postForm=function(e,t){var o=new FormData(t);return new KB.http.request("POST",e,{},o).execute()},KB.http.uploadFile=function(e,t,o,n,a,i){var r=new FormData;r.append("files[]",t);var d=new XMLHttpRequest;d.upload.addEventListener("progress",o),d.upload.addEventListener("error",a),d.open("POST",e,!0),d.setRequestHeader("X-Requested-With","XMLHttpRequest"),d.onreadystatechange=function(){d.readyState===XMLHttpRequest.DONE&&(200===d.status?n():void 0!==i&&i(JSON.parse(d.responseText)))},d.send(r)},function(){function e(e){e.target.matches("#modal-overlay")&&(e.stopPropagation(),e.preventDefault(),s())}function t(){KB.trigger("modal.close")}function o(){KB.trigger("modal.loading"),a()}function n(){return document.querySelector("#modal-content form:not(.js-modal-ignore-form)")}function a(){var e=n();if(e){var t=e.getAttribute("action");t&&KB.http.postForm(t,e).success(function(e){KB.trigger("modal.stop"),e?r(e):s()}).error(function(e){KB.trigger("modal.stop"),e.hasOwnProperty("message")&&window.alert(e.message)})}}function i(){var e=KB.find("#modal-content form");e&&e.on("submit",o,!1);var t=document.querySelector("#modal-content input[autofocus]");t&&t.focus(),KB.render(),_KB.datePicker(),_KB.autoComplete(),_KB.tagAutoComplete(),_KB.get("Task").onPopoverOpened(),KB.trigger("modal.afterRender")}function r(e){var t=KB.find("#modal-content");t&&(t.replace(KB.dom("div").attr("id","modal-content").html(e).build()),i())}function d(o,n,a){var r=KB.dom("a").attr("href","#").attr("id","modal-close-button").html('').click(t).build(),d=KB.dom("div").attr("id","modal-header").add(r).build(),s=KB.dom("div").attr("id","modal-content").html(o).build(),l=KB.dom("div").attr("id","modal-box").style("width",n).add(d).add(s).build(),c=KB.dom("div").attr("id","modal-overlay").add(l).build();a&&c.addEventListener("click",e,!1),document.body.appendChild(c),i()}function s(){c=!1;var e=KB.find("#modal-overlay");e&&(KB.trigger("modal.beforeDestroy"),e.remove())}function l(e){var t=KB.utils.getViewportSize();if(t.width<700)return"99%";switch(e){case"large":return t.width<1350?"98%":"1350px";case"medium":return t.width<1024?"70%":"1024px"}return t.width<800?"75%":"800px"}var c=!1;KB.on("modal.close",function(){s()}),KB.on("modal.submit",function(){a()}),KB.modal={open:function(e,t,o){KB.trigger("modal.open"),_KB.get("Dropdown").close(),s(),void 0===o&&(o=!0),KB.http.get(e).success(function(e){c=!0,d(e,l(t),o)})},close:function(){s()},isOpen:function(){return c},replace:function(e){KB.http.get(e).success(function(e){r(e)})},getForm:n,submitForm:a}}(),KB.utils.formatDuration=function(e){return e>=86400?Math.round(e/86400)+"d":e>=3600?Math.round(e/3600)+"h":e>=60?Math.round(e/60)+"m":e+"s"},KB.utils.getSelectionPosition=function(e){var t,o;return t=e.value.length0&&n.push([l]):s>0?(n[s].push(l),void 0===n[0][d]&&n[0].push(0),n[0][d]+=l):a.push(r(i.parse(l)))}KB.dom(e).add(KB.dom("div").attr("id","chart").build()),c3.generate({data:{columns:n},axis:{x:{type:"category",categories:a}}})}}),KB.component("chart-project-cumulative-flow",function(e,t){this.render=function(){for(var o=t.metrics,n=[],a=[],i=[],r=d3.time.format("%Y-%m-%d"),d=d3.time.format(t.dateFormat),s=0;s0&&(a.push(c),n.push([c])):l>0?n[l-1].push(c):i.push(d(r.parse(c)))}KB.dom(e).add(KB.dom("div").attr("id","chart").build()),c3.generate({data:{columns:n.reverse(),type:"area-spline",groups:[a],order:null},axis:{x:{type:"category",categories:i}}})}}),KB.component("chart-project-lead-cycle-time",function(e,t){this.render=function(){var o=t.metrics,n=[t.labelCycle],a=[t.labelLead],i=[],r={};r[t.labelCycle]="area",r[t.labelLead]="area-spline";var d={};d[t.labelLead]="#afb42b",d[t.labelCycle]="#4e342e";for(var s=0;s