valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix OTP QR code not displayed because of CSRF token passed as a query 

parameter
use type-strict comparison when validating CSRF token on the backend
This commit is contained in:
Andrew Dolgov 2020-09-17 08:43:39 +03:00
parent 6a4b6cf603
commit 1f79d614c4
3 changed files with 27 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
classes/handler/public.php
View File

@ -283,9 +283,12 @@ class Handler_Public extends Handler {
}
function logout() {
if ($_POST["csrf_token"] == $_SESSION["csrf_token"]) {
if (validate_csrf($_POST["csrf_token"])) {
logout_user();
header("Location: index.php");
} else {
header("Content-Type: text/json");
print error_json(6);
}
}
@ -777,7 +780,7 @@ class Handler_Public extends Handler {
<div class='content'>
<?php
if (!$feed_url || $csrf_token != $_SESSION["csrf_token"]) {
if (!$feed_url || !validate_csrf($csrf_token)) {
?>
<form method="post">
<input type="hidden" name="op" value="subscribe">

13
classes/pref/prefs.php
View File

@ -8,7 +8,7 @@ class Pref_Prefs extends Handler_Protected {
private $profile_blacklist = [];
function csrf_ignore($method) {
$csrf_ignored = array("index", "updateself", "customizecss", "editprefprofiles");
$csrf_ignored = array("index", "updateself", "customizecss", "editprefprofiles", "otpqrcode");
return array_search($method, $csrf_ignored) !== false;
}
@ -483,8 +483,8 @@ class Pref_Prefs extends Handler_Protected {
if (function_exists("imagecreatefromstring")) {
print "<h3>" . __("Scan the following code by the Authenticator application or copy the key manually") . "</h3>";
$csrf_token = $_SESSION["csrf_token"];
print "<img alt='otp qr-code' src='backend.php?op=pref-prefs&method=otpqrcode&csrf_token=$csrf_token'>";
$csrf_token_hash = sha1($_SESSION["csrf_token"]);
print "<img alt='otp qr-code' src='backend.php?op=pref-prefs&method=otpqrcode&csrf_token_hash=$csrf_token_hash'>";
} else {
print_error("PHP GD functions are required to generate QR codes.");
print "<h3>" . __("Use the following OTP key with a compatible Authenticator application") . "</h3>";
@ -1010,6 +1010,9 @@ class Pref_Prefs extends Handler_Protected {
}
function otpqrcode() {
$csrf_token_hash = clean($_REQUEST["csrf_token_hash"]);
if (sha1($_SESSION["csrf_token"] === $csrf_token_hash)) {
require_once "lib/phpqrcode/phpqrcode.php";
$sth = $this->pdo->prepare("SELECT login
@ -1026,6 +1029,10 @@ class Pref_Prefs extends Handler_Protected {
"?secret=$secret&issuer=".urlencode("Tiny Tiny RSS"));
}
}
} else {
header("Content-Type: text/json");
print error_json(6);
}
}
function otpenable() {

2
include/functions.php
View File

@ -680,7 +680,7 @@
}
function validate_csrf($csrf_token) {
return $csrf_token == $_SESSION['csrf_token'];
return $csrf_token === $_SESSION['csrf_token'];
}
function load_user_plugins($owner_uid, $pluginhost = false) {