Protect maintenance mode against CSRF.

bigprof-software · Jul 11, 2021 · 41ed219 · 41ed219
1 parent be345e5
commit 41ed219
Show file tree

Hide file tree

Showing 7 changed files with 18 additions and 9 deletions.
diff --git a/app/admin/ajax-maintenance-mode.php b/app/admin/ajax-maintenance-mode.php
@@ -1,9 +1,10 @@
 <?php
-	$currDir = dirname(__FILE__);
-	require("{$currDir}/incCommon.php");
+	require(__DIR__ . '/incCommon.php');
 
 	if(!getLoggedAdmin()) exit;
 
+	if(!csrf_token(true)) exit;
+
 	$status = $_REQUEST['status'];
 	if($status == 'on') maintenance_mode(true);
 	if($status == 'off') maintenance_mode(false);

diff --git a/app/admin/pageEditMember.php b/app/admin/pageEditMember.php
@@ -306,7 +306,7 @@
 	<?php for($cust = 1; $cust <= 4; $cust++) { ?>
 		<?php if($adminConfig["custom{$cust}"] != '') { ?>
 			<div class="form-group">
-				<label for="custom<?php echo $cust; ?>" class="label-classes control-label"><?php echo $adminConfig["custom{$cust}"]; ?></label>
+				<label for="custom<?php echo $cust; ?>" class="label-classes control-label"><?php echo htmlspecialchars($adminConfig["custom{$cust}"]); ?></label>
 				<div class="input-classes">
 					<input class="form-control" type="text" name="custom<?php echo $cust; ?>" id="custom<?php echo $cust; ?>" value="<?php echo $customs[$cust]; ?>" >
 				</div>

diff --git a/app/admin/pageHome.php b/app/admin/pageHome.php
@@ -66,7 +66,11 @@
 		if($j(this).hasClass('locked_active') || $j(this).hasClass('unlocked_inactive')) {
 			if(confirm('<?php echo html_attr($Translation['enable maintenance mode?']); ?>')) {
 				$j.ajax({
-					url: 'ajax-maintenance-mode.php?status=on', 
+					url: 'ajax-maintenance-mode.php', 
+					data: {
+						status: 'on',
+						csrf_token: '<?php echo csrf_token(false, true); ?>'
+					},
 					complete: function() {
 						location.reload();
 					}
@@ -75,7 +79,11 @@
 		} else {
 			if(confirm('<?php echo html_attr($Translation['disable maintenance mode?']); ?>')) {
 				$j.ajax({
-					url: 'ajax-maintenance-mode.php?status=off', 
+					url: 'ajax-maintenance-mode.php', 
+					data: {
+						status: 'off',
+						csrf_token: '<?php echo csrf_token(false, true); ?>'
+					},
 					complete: function() {
 						location.reload();
 					}

diff --git a/app/admin/pageServerStatus.php b/app/admin/pageServerStatus.php
@@ -1,6 +1,6 @@
 <?php
 	$appgini_version = '6.0.1145';
-	$generated_ts = '11/7/2021 1:52:42 AM';
+	$generated_ts = '11/7/2021 2:33:14 AM';
 
 	$currDir = dirname(__FILE__);
 	require("{$currDir}/incCommon.php");

diff --git a/app/membership_profile.php b/app/membership_profile.php
@@ -138,7 +138,7 @@
 
 						<?php for($i=1; $i<5; $i++) { ?>
 							<div class="form-group">
-								<label for="custom<?php echo $i; ?>"><?php echo $adminConfig['custom'.$i]; ?></label>
+								<label for="custom<?php echo $i; ?>"><?php echo htmlspecialchars($adminConfig['custom'.$i]); ?></label>
 								<input type="text" id="custom<?php echo $i; ?>" name="custom<?php echo $i; ?>" value="<?php echo html_attr($mi['custom'][$i-1]); ?>" class="form-control">
 							</div>
 						<?php } ?>

diff --git a/app/membership_signup.php b/app/membership_signup.php
@@ -153,7 +153,7 @@
 										?>
 										<div class="row form-group">
 										   <div class="col-sm-3"><label class="control-label" for="custom<?php echo $cf; ?>"><?php echo htmlspecialchars($adminConfig['custom'.$cf]); ?></label></div>
-										   <div class="col-sm-9"><input class="form-control" type="text" placeholder="<?php echo htmlspecialchars($adminConfig['custom'.$cf]); ?>" id="custom<?php echo $cf; ?>" name="custom<?php echo $cf; ?>"></div>
+										   <div class="col-sm-9"><input class="form-control" type="text" placeholder="<?php echo html_attr($adminConfig['custom'.$cf]); ?>" id="custom<?php echo $cf; ?>" name="custom<?php echo $cf; ?>"></div>
 										</div>
 										<?php
 									}

diff --git a/orpm.axp b/orpm.axp