lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Todo: faille CSRF -- creation d'un jeton alatoire pour valider les requetes POST

Browse Source
This commit is contained in:
Regis Houssin 2009-05-15 12:13:23 +00:00
parent 33df2649ef
commit df37827eb7
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/admin/const.php
View File

@ -30,10 +30,16 @@ require_once(DOL_DOCUMENT_ROOT."/lib/admin.lib.php");
$langs->load("admin"); $langs->load("admin");
//Todo protection faille CSRF !!! //Todo: protection faille CSRF !!!
if (! empty($_SERVER['HTTP_REFERER']) && !eregi(DOL_MAIN_URL_ROOT, $_SERVER['HTTP_REFERER'])) if (! empty($_SERVER['HTTP_REFERER']) && !eregi(DOL_MAIN_URL_ROOT, $_SERVER['HTTP_REFERER']))
accessforbidden(); accessforbidden();
//Todo: Verification de la presence et de la validite du jeton précédent
if (isset($_POST['token']) && isset($_SESSION['oldtoken']))
{
if ($_POST['token'] != $_SESSION['oldtoken']) accessforbidden();
}
if (!$user->admin) if (!$user->admin)
accessforbidden(); accessforbidden();
@ -142,6 +148,9 @@ if ($result)
print '<input type="hidden" name="rowid" value="'.$obj->rowid.'">'; print '<input type="hidden" name="rowid" value="'.$obj->rowid.'">';
print '<input type="hidden" name="constname" value="'.$obj->name.'">'; print '<input type="hidden" name="constname" value="'.$obj->name.'">';
// Ajout du nouveau jeton dans les requetes POST
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print "<tr $bc[$var] class=value><td>$obj->name</td>\n"; print "<tr $bc[$var] class=value><td>$obj->name</td>\n";
// Value // Value

5
htdocs/main.inc.php
View File

@ -168,6 +168,11 @@ session_name($sessionname);
session_start(); session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".(isset($_SESSION["dol_login"])?$_SESSION["dol_login"]:'').", ".ini_get("session.gc_maxlifetime")); dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".(isset($_SESSION["dol_login"])?$_SESSION["dol_login"]:'').", ".ini_get("session.gc_maxlifetime"));
//Todo: Creation d'un jeton contre les failles CSRF
$token = md5(uniqid(rand(),TRUE)); // Genere un hash d'un nombre aleatoire
$_SESSION['oldtoken'] = $_SESSION['newtoken']; // roulement des jetons car créé à chaque appel
$_SESSION['newtoken'] = $token;
// Retrieve the entity in login form or in the cookie. // Retrieve the entity in login form or in the cookie.
// This must be after the init of session (session_start) or this create serious pb of corrupted session. // This must be after the init of session (session_start) or this create serious pb of corrupted session.
/* /*