Skip to content

Commit 4e67cc8

Browse files
VINADES.,JSCvuthao
VINADES.,JSC
authored and
vuthao
committed
Fix CSRF for module authors
1 parent 4c395f9 commit 4e67cc8

File tree

13 files changed

+193
-163
lines changed

13 files changed

+193
-163
lines changed

‎admin/authors/add.php

+5-1
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,11 @@
4949
$adminThemes = [''];
5050
$adminThemes = array_merge($adminThemes, nv_scandir(NV_ROOTDIR . '/themes', $global_config['check_theme_admin']));
5151
unset($adminThemes[0]);
52-
52+
$checkss = md5(NV_CHECK_SESSION . '_' . $module_name . '_' . $op . '_' . $admin_info['userid']);
5353
if ($nv_Request->get_int('save', 'post', 0)) {
54+
if ($checkss != $nv_Request->get_string('checkss', 'post')) {
55+
nv_htmlOutput('Error Session, Please close the browser and try again');
56+
}
5457
$userid = $nv_Request->get_title('userid', 'post', 0);
5558
$lev = $nv_Request->get_int('lev', 'post', 0);
5659
$editor = $nv_Request->get_title('editor', 'post');
@@ -273,6 +276,7 @@
273276
$xtpl->assign('RESULT_URL', NV_BASE_ADMINURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name . '&' . NV_OP_VARIABLE . '=add&result=1&checksess=' . NV_CHECK_SESSION);
274277
$xtpl->assign('FILTERSQL', $crypt->encrypt($filtersql, NV_CHECK_SESSION));
275278
$xtpl->assign('ACTION', $contents['action']);
279+
$xtpl->assign('CHECKSS', $checkss);
276280

277281
foreach ($adminThemes as $_admin_theme) {
278282
$xtpl->assign('THEME_NAME', $_admin_theme);

‎admin/authors/config.php

+133-123
Large diffs are not rendered by default.

‎admin/authors/del.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@ function nv_checkAdmpass($adminpass)
6565
$action_account = $nv_Request->get_int('action_account', 'post', 0);
6666
$action_account = (isset($array_action_account[$action_account])) ? $action_account : 0;
6767
$error = '';
68-
$checkss = md5($admin_id . NV_CHECK_SESSION);
69-
if ($nv_Request->get_title('ok', 'post', 0) == $checkss) {
68+
$checkss = md5(NV_CHECK_SESSION . '_' . $module_name . '_' . $op . '_' . $admin_id);
69+
if ($nv_Request->get_title('checkss', 'post') == $checkss) {
7070
$sendmail = $nv_Request->get_int('sendmail', 'post', 0);
7171
$reason = $nv_Request->get_title('reason', 'post', '', 1);
7272
$adminpass = $nv_Request->get_title('adminpass_iavim', 'post');

‎admin/authors/edit.php

+5-1
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,11 @@
6969
$adminThemes = [''];
7070
$adminThemes = array_merge($adminThemes, nv_scandir(NV_ROOTDIR . '/themes', $global_config['check_theme_admin']));
7171
unset($adminThemes[0]);
72-
72+
$checkss = md5(NV_CHECK_SESSION . '_' . $module_name . '_' . $op . '_' . $admin_id);
7373
if ($nv_Request->get_int('save', 'post', 0)) {
74+
if ($checkss != $nv_Request->get_string('checkss', 'post')) {
75+
nv_redirect_location(NV_BASE_ADMINURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name);
76+
}
7477
$editor = $nv_Request->get_title('editor', 'post', '');
7578
if (defined('NV_IS_SPADMIN')) {
7679
$allow_files_type = $nv_Request->get_array('allow_files_type', 'post', []);
@@ -393,6 +396,7 @@
393396
$xtpl->assign('INFO', $contents['info']);
394397
$xtpl->assign('ACTION', $contents['action']);
395398
$xtpl->assign('LANG', $lang_module);
399+
$xtpl->assign('CHECKSS', $checkss);
396400

397401
foreach ($adminThemes as $_admin_theme) {
398402
$xtpl->assign('THEME_NAME', $_admin_theme);

‎admin/authors/module.php

+33-29
Original file line numberDiff line numberDiff line change
@@ -12,42 +12,45 @@
1212
die('Stop!!!');
1313
}
1414

15+
$checkss = md5(NV_CHECK_SESSION . '_' . $module_name . '_' . $op . '_' . $admin_info['userid']);
1516
if (defined('NV_IS_AJAX')) {
16-
if ($nv_Request->isset_request('changeweight', 'post')) {
17-
$mid = $nv_Request->get_int('changeweight', 'post', 0);
18-
$new_vid = $nv_Request->get_int('new_vid', 'post', 0);
17+
if ($checkss == $nv_Request->get_string('checkss', 'post')) {
18+
if ($nv_Request->isset_request('changeweight', 'post')) {
19+
$mid = $nv_Request->get_int('changeweight', 'post', 0);
20+
$new_vid = $nv_Request->get_int('new_vid', 'post', 0);
1921

20-
$query = 'SELECT mid FROM ' . NV_AUTHORS_GLOBALTABLE . '_module WHERE mid!=' . $mid . ' ORDER BY weight ASC';
21-
$result = $db->query($query);
22-
$weight = 0;
23-
while ($row = $result->fetch()) {
24-
++$weight;
25-
if ($weight == $new_vid) {
22+
$query = 'SELECT mid FROM ' . NV_AUTHORS_GLOBALTABLE . '_module WHERE mid!=' . $mid . ' ORDER BY weight ASC';
23+
$result = $db->query($query);
24+
$weight = 0;
25+
while ($row = $result->fetch()) {
2626
++$weight;
27+
if ($weight == $new_vid) {
28+
++$weight;
29+
}
30+
$db->query('UPDATE ' . NV_AUTHORS_GLOBALTABLE . '_module SET weight=' . $weight . ' WHERE mid=' . $row['mid']);
2731
}
28-
$db->query('UPDATE ' . NV_AUTHORS_GLOBALTABLE . '_module SET weight=' . $weight . ' WHERE mid=' . $row['mid']);
29-
}
30-
$db->query('UPDATE ' . NV_AUTHORS_GLOBALTABLE . '_module SET weight=' . $new_vid . ' WHERE mid=' . $mid);
31-
} elseif ($nv_Request->isset_request('changact', 'post')) {
32-
$mid = $nv_Request->get_int('mid', 'post', 0);
33-
$act = $nv_Request->get_int('changact', 'post', 1);
34-
$query = 'SELECT * FROM ' . NV_AUTHORS_GLOBALTABLE . '_module WHERE mid=' . $mid;
35-
$row = $db->query($query)->fetch();
36-
if (!empty($row)) {
37-
$save = true;
38-
if ($act == 3 and ($row['module'] == 'database' or $row['module'] == 'settings' or $row['module'] == 'site')) {
39-
$save = false;
40-
} elseif ($act == 1 and ($row['module'] == 'authors' or $row['module'] == 'siteinfo')) {
41-
$save = false;
42-
}
32+
$db->query('UPDATE ' . NV_AUTHORS_GLOBALTABLE . '_module SET weight=' . $new_vid . ' WHERE mid=' . $mid);
33+
} elseif ($nv_Request->isset_request('changact', 'post')) {
34+
$mid = $nv_Request->get_int('mid', 'post', 0);
35+
$act = $nv_Request->get_int('changact', 'post', 1);
36+
$query = 'SELECT * FROM ' . NV_AUTHORS_GLOBALTABLE . '_module WHERE mid=' . $mid;
37+
$row = $db->query($query)->fetch();
38+
if (!empty($row)) {
39+
$save = true;
40+
if ($act == 3 and ($row['module'] == 'database' or $row['module'] == 'settings' or $row['module'] == 'site')) {
41+
$save = false;
42+
} elseif ($act == 1 and ($row['module'] == 'authors' or $row['module'] == 'siteinfo')) {
43+
$save = false;
44+
}
4345

44-
if ($save) {
45-
$act_val = ($row['act_' . $act]) ? 0 : 1;
46-
$checksum = md5($row['module'] . '#' . $row['act_1'] . '#' . $row['act_2'] . '#' . $row['act_3'] . '#' . $global_config['sitekey']);
47-
$db->query("UPDATE " . NV_AUTHORS_GLOBALTABLE . "_module SET act_" . $act . " = '" . $act_val . "', checksum = '" . $checksum . "' WHERE mid = " . $mid);
46+
if ($save) {
47+
$act_val = ($row['act_' . $act]) ? 0 : 1;
48+
$checksum = md5($row['module'] . '#' . $row['act_1'] . '#' . $row['act_2'] . '#' . $row['act_3'] . '#' . $global_config['sitekey']);
49+
$db->query("UPDATE " . NV_AUTHORS_GLOBALTABLE . "_module SET act_" . $act . " = '" . $act_val . "', checksum = '" . $checksum . "' WHERE mid = " . $mid);
50+
}
4851
}
52+
die('OK');
4953
}
50-
die('OK');
5154
}
5255
}
5356

@@ -61,6 +64,7 @@
6164
$xtpl->assign('NV_OP_VARIABLE', NV_OP_VARIABLE);
6265
$xtpl->assign('MODULE_NAME', $module_name);
6366
$xtpl->assign('NV_LANG_INTERFACE', NV_LANG_INTERFACE);
67+
$xtpl->assign('CHECKSS', $checkss);
6468

6569
$a = 0;
6670
$rows = $db->query('SELECT * FROM ' . NV_AUTHORS_GLOBALTABLE . '_module ORDER BY weight ASC')->fetchAll();

‎admin/authors/suspend.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
}
1818

1919
$admin_id = $nv_Request->get_int('admin_id', 'get', 0);
20+
$checkss = md5(NV_CHECK_SESSION . '_' . $module_name . '_' . $op . '_' . $admin_id);
2021

2122
if (empty($admin_id) or $admin_id == $admin_info['admin_id']) {
2223
nv_redirect_location(NV_BASE_ADMINURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name);
@@ -62,7 +63,7 @@
6263

6364
if (! empty($new_suspend) and empty($new_reason)) {
6465
$error = sprintf($lang_module['susp_reason_empty'], $row_user['username']);
65-
} else {
66+
} elseif ($checkss == $nv_Request->get_string('checkss', 'post')) {
6667
if ($new_suspend) {
6768
if ($clean_history) {
6869
$susp_reason = array();
@@ -211,6 +212,7 @@
211212
// Parse content
212213
$xtpl = new XTemplate('suspend.tpl', NV_ROOTDIR . '/themes/' . $global_config['module_theme'] . '/modules/' . $module_file);
213214
$xtpl->assign('SUSPEND_INFO', $contents['suspend_info'][0]);
215+
$xtpl->assign('CHECKSS', $checkss);
214216

215217
if (empty($contents['suspend_info'][1])) {
216218
$xtpl->parse('suspend.suspend_info');

‎themes/admin_default/js/authors.js

+4-2
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ function nv_admin_edit_result(form_id, go, tp) {
2525
function nv_chang_weight(mid) {
2626
var nv_timer = nv_settimeout_disable('id_weight_' + mid, 5000);
2727
var new_vid = $("#id_weight_" + mid).val();
28-
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=module&nocache=' + new Date().getTime(), 'changeweight=' + mid + '&new_vid=' + new_vid, function(res) {
28+
var checkss = $("input[name='checkss']").val();
29+
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=module&nocache=' + new Date().getTime(), 'changeweight=' + mid + '&new_vid=' + new_vid + '&checkss=' + checkss, function(res) {
2930
$("#main_module").html(res);
3031
});
3132
return;
@@ -34,7 +35,8 @@ function nv_chang_weight(mid) {
3435
function nv_chang_act(mid, act) {
3536
if (confirm(nv_is_change_act_confirm[0])) {
3637
var nv_timer = nv_settimeout_disable('change_act_' + act + '_' + mid, 5000);
37-
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=module&nocache=' + new Date().getTime(), 'changact=' + act + '&mid=' + mid, function(res) {
38+
var checkss = $("input[name='checkss']").val();
39+
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=module&nocache=' + new Date().getTime(), 'changact=' + act + '&mid=' + mid + '&checkss=' + checkss, function(res) {
3840
nv_set_disable_false('change_act_' + act + '_' + mid);
3941
});
4042
} else {

‎themes/admin_default/modules/authors/add.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
</colgroup>
99
<tfoot>
1010
<tr>
11-
<td colspan="2" class="text-center"><input name="save" id="save" type="hidden" value="1" /><input name="go_add" type="submit" value="{SUBMIT}" class="btn btn-primary" /></td>
11+
<td colspan="2" class="text-center"><input type="hidden" name="checkss" value="{CHECKSS}" /><input name="save" id="save" type="hidden" value="1" /><input name="go_add" type="submit" value="{SUBMIT}" class="btn btn-primary" /></td>
1212
</tr>
1313
</tfoot>
1414
<tbody>

‎themes/admin_default/modules/authors/config.tpl

+3
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
<form action="{NV_BASE_ADMINURL}index.php" method="post" id="frm">
1212
<input type="hidden" name="{NV_NAME_VARIABLE}" value="{MODULE_NAME}" />
1313
<input type="hidden" name="{NV_OP_VARIABLE}" value="{OP}" />
14+
<input type="hidden" name="checkss" value="{CHECKSS}" />
1415
<div class="table-responsive">
1516
<table class="table table-striped table-bordered table-hover">
1617
<thead>
@@ -81,6 +82,7 @@
8182
<input type="hidden" name="{NV_NAME_VARIABLE}" value="{MODULE_NAME}" />
8283
<input type="hidden" name="{NV_OP_VARIABLE}" value="{OP}" />
8384
<input type="hidden" name="uid" value="{FIREWALLDATA.uid}" />
85+
<input type="hidden" name="checkss" value="{CHECKSS}" />
8486
<div class="table-responsive">
8587
<table class="table table-striped table-bordered table-hover">
8688
<thead>
@@ -160,6 +162,7 @@
160162
<input type="hidden" name="{NV_NAME_VARIABLE}" value="{MODULE_NAME}" />
161163
<input type="hidden" name="{NV_OP_VARIABLE}" value="{OP}" />
162164
<input type="hidden" name="cid" value="{IPDATA.cid}" />
165+
<input type="hidden" name="checkss" value="{CHECKSS}" />
163166
<div class="panel panel-default">
164167
<div class="panel-heading"><strong>{LANG.adminip_add}</strong></div>
165168
<div class="panel-body">

‎themes/admin_default/modules/authors/del.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<table class="table table-striped table-bordered table-hover">
66
<tfoot>
77
<tr>
8-
<td colspan="3"><input name="ok" type="hidden" value="{CHECKSS}" /><input name="go_del" type="submit" value="{LANG.nv_admin_del}" class="btn btn-danger" /></td>
8+
<td colspan="3"><input name="checkss" type="hidden" value="{CHECKSS}" /><input name="go_del" type="submit" value="{LANG.nv_admin_del}" class="btn btn-danger" /></td>
99
</tr>
1010
</tfoot>
1111
<tbody>

‎themes/admin_default/modules/authors/edit.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
</colgroup>
99
<tfoot>
1010
<tr>
11-
<td colspan="2" class="text-center"><input name="save" id="save" type="hidden" value="1" /><input name="go_edit" type="submit" value="{LANG.save}" class="btn btn-primary" /></td>
11+
<td colspan="2" class="text-center"><input type="hidden" name="checkss" value="{CHECKSS}" /><input name="save" id="save" type="hidden" value="1" /><input name="go_edit" type="submit" value="{LANG.save}" class="btn btn-primary" /></td>
1212
</tr>
1313
</tfoot>
1414
<tbody>

‎themes/admin_default/modules/authors/module.tpl

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<!-- BEGIN: main -->
22
<div id="main_module">
33
<div class="table-responsive">
4+
<input type="hidden" name="checkss" value="{CHECKSS}" />
45
<table class="table table-striped table-bordered table-hover">
56
<thead>
67
<tr class="text-center">

‎themes/admin_default/modules/authors/suspend.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
</colgroup>
4141
<tfoot>
4242
<tr>
43-
<td colspan="2"><input name="save" type="hidden" value="1" /></td>
43+
<td colspan="2"><input name="save" type="hidden" value="1" /><input type="hidden" name="checkss" value="{CHECKSS}" /></td>
4444
<td><input name="go_change" type="submit" value="{SUBMIT}" class="btn btn-primary" /></td>
4545
</tr>
4646
</tfoot>

0 commit comments

Comments
 (0)