valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pluginhandlers: post notice if pluginmethod is requested without CSRF token

This commit is contained in:
Andrew Dolgov 2021-02-17 14:05:12 +03:00
parent 00b31c3f53
commit d439685895
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
classes/pluginhandler.php
View File

@ -7,16 +7,22 @@ class PluginHandler extends Handler_Protected {
function catchall($method) {
$plugin_name = clean($_REQUEST["plugin"]);
$plugin = PluginHost::getInstance()->get_plugin($plugin_name);
$csrf_token = ($_POST["csrf_token"] ?? "");
if ($plugin) {
if (method_exists($plugin, $method)) {
$plugin->$method();
if (validate_csrf($csrf_token)) {
$plugin->$method();
} else {
user_error("Requested ${plugin_name}->${method}() with invalid CSRF token.", E_USER_DEPRECATED);
$plugin->$method();
}
} else {
user_error("PluginHandler: Requested unknown method '$method' of plugin '$plugin_name'.", E_USER_WARNING);
user_error("Rejected ${plugin_name}->${method}(): unknown method.", E_USER_WARNING);
print error_json(13);
}
} else {
user_error("PluginHandler: Requested method '$method' of unknown plugin '$plugin_name'.", E_USER_WARNING);
user_error("Rejected ${plugin_name}->${method}(): unknown plugin.", E_USER_WARNING);
print error_json(14);
}
}