Skip to content

Commit e9e8890

Browse files
VINADES.,JSCvuthao
VINADES.,JSC
authored and
vuthao
committed
Fix CSRF for setup modules
1 parent e5d41b3 commit e9e8890

File tree

9 files changed

+61
-53
lines changed

9 files changed

+61
-53
lines changed

‎admin/modules/change_act.php

+25-26
Original file line numberDiff line numberDiff line change
@@ -7,47 +7,46 @@
77
* @License GNU/GPL version 2 or any later version
88
* @Createdate 2-10-2010 19:49
99
*/
10-
11-
if (! defined('NV_IS_FILE_MODULES')) {
10+
if (!defined('NV_IS_FILE_MODULES')) {
1211
die('Stop!!!');
1312
}
1413

1514
$mod = $nv_Request->get_title('mod', 'post');
1615

17-
if (empty($mod) or ! preg_match($global_config['check_module'], $mod)) {
16+
if (empty($mod) or !preg_match($global_config['check_module'], $mod)) {
1817
die('NO_' . $mod);
1918
}
19+
if (md5(NV_CHECK_SESSION . '_' . $module_name . '_change_act_' . $mod) == $nv_Request->get_string('checkss', 'post')) {
20+
$sth = $db->prepare('SELECT act, module_file FROM ' . NV_MODULES_TABLE . ' WHERE title= :title');
21+
$sth->bindParam(':title', $mod, PDO::PARAM_STR);
22+
$sth->execute();
23+
$row = $sth->fetch();
24+
if (empty($row)) {
25+
die('NO_' . $mod);
26+
}
2027

21-
$sth = $db->prepare('SELECT act, module_file FROM ' . NV_MODULES_TABLE . ' WHERE title= :title');
22-
$sth->bindParam(':title', $mod, PDO::PARAM_STR);
23-
$sth->execute();
24-
$row = $sth->fetch();
25-
if (empty($row)) {
26-
die('NO_' . $mod);
27-
}
28+
$act = intval($row['act']);
2829

29-
$act = intval($row['act']);
30+
if ($act == 2) {
31+
if (!is_dir(NV_ROOTDIR . '/modules/' . $row['module_file'])) {
32+
die('NO_' . $mod);
33+
}
34+
}
3035

31-
if ($act == 2) {
32-
if (! is_dir(NV_ROOTDIR . '/modules/' . $row['module_file'])) {
36+
$act = ($act != 1) ? 1 : 0;
37+
if ($act == 0 and $mod == $global_config['site_home_module']) {
3338
die('NO_' . $mod);
3439
}
35-
}
36-
37-
$act = ($act != 1) ? 1 : 0;
38-
if ($act == 0 and $mod == $global_config['site_home_module']) {
39-
die('NO_' . $mod);
40-
}
41-
42-
$sth = $db->prepare('UPDATE ' . NV_MODULES_TABLE . ' SET act=' . $act . ' WHERE title= :title');
43-
$sth->bindParam(':title', $mod, PDO::PARAM_STR);
44-
$sth->execute();
4540

46-
$nv_Cache->delMod('modules');
41+
$sth = $db->prepare('UPDATE ' . NV_MODULES_TABLE . ' SET act=' . $act . ' WHERE title= :title');
42+
$sth->bindParam(':title', $mod, PDO::PARAM_STR);
43+
$sth->execute();
4744

48-
$temp = ($act == 1) ? $lang_global['yes'] : $lang_global['no'];
49-
nv_insert_logs(NV_LANG_DATA, $module_name, $lang_global['activate'] . ' module "' . $mod . '"', $temp, $admin_info['userid']);
45+
$nv_Cache->delMod('modules');
5046

47+
$temp = ($act == 1) ? $lang_global['yes'] : $lang_global['no'];
48+
nv_insert_logs(NV_LANG_DATA, $module_name, $lang_global['activate'] . ' module "' . $mod . '"', $temp, $admin_info['userid']);
49+
}
5150
include NV_ROOTDIR . '/includes/header.php';
5251
echo 'OK_' . $mod;
5352
include NV_ROOTDIR . '/includes/footer.php';

‎admin/modules/check_sample_data.php

+18-15
Original file line numberDiff line numberDiff line change
@@ -13,43 +13,46 @@
1313
}
1414

1515
if ($nv_Request->isset_request('module', 'post')) {
16-
$module_name = $nv_Request->get_title('module', 'post');
16+
$modname = $nv_Request->get_title('module', 'post');
1717
$is_setup = $nv_Request->get_int('setup', 'post', 0);
1818

1919
$contents = array(
2020
'status' => 'error',
21-
'module' => $module_name,
22-
'message' => array( 0 => 'Module not exists' ),
21+
'module' => $modname,
22+
'message' => array(
23+
0 => 'Module not exists'
24+
),
25+
'checkss' => md5(NV_CHECK_SESSION . '_' . $module_name . '_setup_mod_' . $modname),
2326
'code' => 0
2427
);
2528

26-
if (! empty($module_name) and preg_match($global_config['check_module'], $module_name)) {
29+
if (! empty($modname) and preg_match($global_config['check_module'], $modname)) {
2730
$sth = $db->prepare('SELECT module_file FROM ' . $db_config['prefix'] . '_' . NV_LANG_DATA . '_modules WHERE title= :title');
28-
$sth->bindParam(':title', $module_name, PDO::PARAM_STR);
31+
$sth->bindParam(':title', $modname, PDO::PARAM_STR);
2932
$sth->execute();
30-
list($module_file) = $sth->fetch(3);
33+
list($modfile) = $sth->fetch(3);
3134

32-
if (empty($module_file)) {
35+
if (empty($modfile)) {
3336
$sth = $db->prepare('SELECT basename FROM ' . $db_config['prefix'] . '_setup_extensions WHERE title=:title AND type=\'module\'');
34-
$sth->bindParam(':title', $module_name, PDO::PARAM_STR);
37+
$sth->bindParam(':title', $modname, PDO::PARAM_STR);
3538
$sth->execute();
36-
list($module_file) = $sth->fetch(3);
39+
list($modfile) = $sth->fetch(3);
3740

38-
if (empty($module_file) and file_exists(NV_ROOTDIR . '/modules/' . $module_name . '/version.php')) {
39-
$module_file = $module_name;
41+
if (empty($modfile) and file_exists(NV_ROOTDIR . '/modules/' . $modname . '/version.php')) {
42+
$modfile = $modname;
4043
}
4144
}
4245

43-
if (! empty($module_file)) {
46+
if (! empty($modfile)) {
4447
$contents['status'] = 'success';
4548
$contents['message'][0] = $lang_module['reinstall_note1'];
4649

4750
// Check sample data file
48-
if (file_exists(NV_ROOTDIR . '/modules/' . $module_file . '/language/data_' . NV_LANG_DATA . '.php')) {
51+
if (file_exists(NV_ROOTDIR . '/modules/' . $modfile . '/language/data_' . NV_LANG_DATA . '.php')) {
4952
$contents['message'][1] = $lang_module['reinstall_note2'];
5053
$contents['message'][2] = $lang_module['reinstall_note3'];
5154
$contents['code'] = 1;
52-
} elseif (file_exists(NV_ROOTDIR . '/modules/' . $module_file . '/language/data_en.php')) {
55+
} elseif (file_exists(NV_ROOTDIR . '/modules/' . $modfile . '/language/data_en.php')) {
5356
$contents['message'][1] = $lang_module['reinstall_note2'];
5457
$contents['message'][2] = $lang_module['reinstall_note4'];
5558
$contents['code'] = 1;
@@ -60,4 +63,4 @@
6063
nv_jsonOutput($contents);
6164
}
6265

63-
nv_redirect_location(NV_BASE_ADMINURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name);
66+
nv_redirect_location(NV_BASE_ADMINURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $modname);

‎admin/modules/del.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
$modname = $nv_Request->get_title('mod', 'post');
1616
$contents = 'NO_' . $modname;
1717

18-
if (! empty($modname) and preg_match($global_config['check_module'], $modname)) {
18+
if (!empty($modname) and preg_match($global_config['check_module'], $modname) and md5(NV_CHECK_SESSION . '_' . $module_name . '_del_' . $modname) == $nv_Request->get_string('checkss', 'post')) {
1919
$sth = $db->prepare('SELECT is_sys, basename FROM ' . $db_config['prefix'] . '_setup_extensions WHERE title= :title AND type=\'module\'');
2020
$sth->bindParam(':title', $modname, PDO::PARAM_STR);
2121
$sth->execute();

‎admin/modules/edit.php

+3-2
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,8 @@
7272

7373
$groups_list = nv_groups_list();
7474

75-
if ($nv_Request->get_int('save', 'post') == '1') {
75+
$checkss = md5(NV_CHECK_SESSION . '_' . $module_name . '_' . $op . '_' . $admin_info['userid']);
76+
if ($checkss == $nv_Request->get_string('checkss', 'post')) {
7677
$custom_title = $nv_Request->get_title('custom_title', 'post', '', 1);
7778
$site_title = $nv_Request->get_title('site_title', 'post', '');
7879
$admin_title = $nv_Request->get_title('admin_title', 'post', '', 1);
@@ -274,7 +275,7 @@
274275
$data['keywords'] = $keywords;
275276
$data['mod_name'] = $mod;
276277
$data['module_theme'] = $module_theme;
277-
278+
$data['checkss'] = $checkss;
278279
if ($mod != $global_config['site_home_module']) {
279280
$data['groups_view'] = [$lang_global['groups_view'], $groups_list, $groups_view];
280281
} else {

‎admin/modules/list.php

+5-2
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,13 @@
8383
$mod['version'] = preg_replace_callback('/^([0-9a-zA-Z]+\.[0-9a-zA-Z]+\.[0-9a-zA-Z]+)\s+(\d+)$/', 'nv_parse_vers', $row['version']);
8484
$mod['custom_title'] = $row['custom_title'];
8585
$mod['weight'] = array( $row['weight'], "nv_chang_weight('" . $row['title'] . "');" );
86-
$mod['act'] = array( $row['act'], "nv_chang_act('" . $row['title'] . "');" );
86+
$mod['act'] = array(
87+
$row['act'],
88+
"nv_chang_act('" . $row['title'] . "', '" . md5(NV_CHECK_SESSION . '_' . $module_name . '_change_act_' . $row['title']) . "');"
89+
);
8790

8891
$mod['edit'] = array( NV_BASE_ADMINURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name . '&' . NV_OP_VARIABLE . '=edit&mod=' . $row['title'], $lang_global['edit'] );
89-
$mod['del'] = ($row['is_sys'] == 0 or $row['title'] != $row['module_file']) ? array( "nv_mod_del('" . $row['title'] . "');", $lang_global['delete'] ) : array();
92+
$mod['del'] = ($row['is_sys'] == 0 or $row['title'] != $row['module_file']) ? array( "nv_mod_del('" . $row['title'] . "', '" . md5(NV_CHECK_SESSION . '_' . $module_name . '_del_' . $row['title']) . "');", $lang_global['delete'] ) : array();
9093

9194
if ($row['title'] == $global_config['site_home_module']) {
9295
$row['is_sys'] = 1;

‎admin/modules/recreate_mod.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
$modname = $nv_Request->get_title('mod', 'post');
1717
$sample = $nv_Request->get_int('sample', 'post', 0);
1818

19-
if (! empty($modname) and preg_match($global_config['check_module'], $modname)) {
19+
if (! empty($modname) and preg_match($global_config['check_module'], $modname) and md5(NV_CHECK_SESSION . '_' . $module_name . '_setup_mod_' . $modname) == $nv_Request->get_string('checkss', 'post')) {
2020
nv_insert_logs(NV_LANG_DATA, $module_name, $lang_global['recreate'] . ' module "' . $modname . '"', '', $admin_info['userid']);
2121
$contents = nv_setup_data_module(NV_LANG_DATA, $modname, $sample);
2222
}

‎themes/admin_default/js/modules.js

+6-5
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ function nv_chang_weight(modname) {
4545
return;
4646
}
4747

48-
function nv_chang_act(modname) {
48+
function nv_chang_act(modname, checkss) {
4949
if (confirm(nv_is_change_act_confirm[0])) {
5050
var nv_timer = nv_settimeout_disable('change_act_' + modname, 5000);
51-
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=change_act&nocache=' + new Date().getTime(), 'mod=' + modname, function(res) {
51+
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=change_act&nocache=' + new Date().getTime(), 'mod=' + modname + '&checkss=' + checkss, function(res) {
5252
var r_split = res.split("_");
5353
if (r_split[0] != 'OK') {
5454
alert(nv_is_change_act_confirm[2]);
@@ -63,9 +63,9 @@ function nv_chang_act(modname) {
6363
return;
6464
}
6565

66-
function nv_mod_del(modname) {
66+
function nv_mod_del(modname, checkss) {
6767
if (confirm(nv_is_del_confirm[0])) {
68-
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=del&nocache=' + new Date().getTime(), 'mod=' + modname, function(res) {
68+
$.post(script_name + '?' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=del&nocache=' + new Date().getTime(), 'mod=' + modname + '&checkss=' + checkss, function(res) {
6969
var r_split = res.split("_");
7070
if (r_split[0] == 'OK') {
7171
window.location.href = script_name + '?' + nv_name_variable + '=modules&' + nv_randomPassword(6) + '=' + nv_randomPassword(8);
@@ -240,6 +240,7 @@ $(document).ready(function(){
240240
dataType: 'json',
241241
success: function(e){
242242
if( e.status == 'success' ){
243+
$("input[name='checkss']").val(e.checkss);
243244
var option = $this.find('option');
244245
option.removeClass('hidden');
245246
option.prop('selected', false);
@@ -269,7 +270,7 @@ $(document).ready(function(){
269270
type: 'POST',
270271
cache: false,
271272
url: script_name + '?' + nv_lang_variable + '=' + nv_lang_data + '&' + nv_name_variable + '=' + nv_module_name + '&' + nv_fc_variable + '=recreate_mod&nocache=' + new Date().getTime(),
272-
data: 'mod=' + $container.data('title') + '&sample=' + $container.find('.option').val(),
273+
data : 'mod=' + $container.data('title') + '&checkss=' + $('input[name=checkss]').val() + '&sample=' + $container.find('.option').val(),
273274
success: function(e){
274275
$container.modal('hide');
275276
var r_split = e.split("_");

‎themes/admin_default/modules/modules/edit.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<tfoot>
99
<tr>
1010
<td colspan="2" class="text-center">
11-
<input name="save" id="save" type="hidden" value="1" />
11+
<input type="hidden" name="checkss" value="{DATA.checkss}" />
1212
<input name="module_theme" type="hidden" value="{DATA.module_theme}" />
1313
<input name="go_add" type="submit" value="{DATA.submit}" class="btn btn-primary" />
1414
</td>

‎themes/admin_default/modules/modules/main.tpl

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
</div>
3232
</div>
3333
<div class="modal-footer">
34+
<input type="hidden" name="checkss" value="" />
3435
<button type="button" class="btn btn-primary submit">{GLANG.submit}</button>
3536
<button type="button" class="btn btn-default" data-dismiss="modal">{GLANG.cancel}</button>
3637
</div>

0 commit comments

Comments
 (0)