From b6c99341a539a44b051064d579459c18661e8be9 Mon Sep 17 00:00:00 2001 From: Craig Knudsen Date: Fri, 15 Oct 2021 12:12:05 -0400 Subject: [PATCH] Fix CWE-1004 by preventing access to cookies within JS - Details for CWE-1004: https://cwe.mitre.org/data/definitions/1004.html --- edit_remotes.php | 143 ----------------------------------------- includes/functions.php | 6 +- includes/js/util.js | 35 ---------- remotes.php | 43 ------------- 4 files changed, 3 insertions(+), 224 deletions(-) delete mode 100644 edit_remotes.php delete mode 100644 remotes.php diff --git a/edit_remotes.php b/edit_remotes.php deleted file mode 100644 index d5b537f99..000000000 --- a/edit_remotes.php +++ /dev/null @@ -1,143 +0,0 @@ - - * @copyright Craig Knudsen, , http://www.k5n.us/cknudsen - * @license http://www.gnu.org/licenses/gpl.html GNU GPL - * @package WebCalendar - * @subpackage Edit Remotes - * - * Security - * $REMOTES_ENABLED must be enabled under System Settings and if - * if UAC is enabled, then the user must be allowed to ACCESS_IMPORT. -*/ -include_once 'includes/init.php'; -print_header ( array ( 'js/edit_remotes.php/false', 'js/visible.php' ), - '', '', true ); - -$error = ''; - -if ( ! $NONUSER_PREFIX ) - $error = translate ( 'NONUSER_PREFIX not set' ); - -if ( $REMOTES_ENABLED != 'Y' || ( access_is_enabled() && ! - access_can_access_function ( ACCESS_IMPORT ) ) ) - $error = print_not_auth(); - -if ( $error ) { - echo print_error ( $error ) . ' - -'; - exit; -} -$add = getValue ( 'add' ); -$nid = getValue ( 'nid' ); - -// Adding/Editing remote calendar. -if ( ( $add == '1' || ! empty ( $nid ) ) && empty ( $error ) ) { - $userlist = get_nonuser_cals ( $login, true ); - - if ( empty ( $nid ) ) { - $id_display = ' ' - . translate ( 'word characters only' ); - $lableStr = translate ( 'Add Remote Calendar' ); - } else { - $nid = clean_html ( $nid ); - nonuser_load_variables ( $nid, 'remotestemp_' ); - - $button = translate ( 'Save' ); - $buttonAction = 'Save'; - $id_display = $nid . ' '; - $lableStr = translate ( 'Edit Remote Calendar' ); - $remotestemp_login = substr ( $remotestemp_login, strlen ( $NONUSER_PREFIX ) ); - } - - $button = translate ( 'Add' ); - $buttonAction = 'Add'; - $calIdStr = translate ( 'Calendar ID' ); - $colorStr = translate ( 'Color' ); - $confirmStr = translate( 'Are you sure you want to delete this entry?' ); - $createLayerStr = translate ( 'Create Layer' ); - $deleteStr = translate ( 'Delete' ); - $firstNameStr = translate ( 'First Name' ); - $lastNameStr = translate ( 'Last Name' ); - $reloadStr = translate ( 'Reload' ); - $requiredStr = translate ( 'Required to View Remote Calendar' ); - $selectStr = translate ( 'Select' ); - $urlStr = translate ( 'URL' ); - - $firstNameValue = ( empty ( $remotestemp_firstname ) - ? '' : htmlspecialchars ( $remotestemp_firstname ) ); - $lastNameValue = ( empty ( $remotestemp_lastname ) - ? '' : htmlspecialchars ( $remotestemp_lastname ) ); - $urlValue = ( empty ( $remotestemp_url ) - ? '' : htmlspecialchars ( $remotestemp_url ) ); - - $formKey = csrf_form_key(); - echo <<{$lableStr} -
- ${formKey} - - - - - - - - - - - - - - - - - -EOT; - if ( empty ( $nid ) ) { - echo << - - - - - - '; - } - echo << - - -EOT; - - if ( ! empty ( $nid ) ) - echo << - -EOT; - - echo ' - '; -} -echo print_trailer ( false, true, true ); - -?> diff --git a/includes/functions.php b/includes/functions.php index 580d6f269..4cad92f3c 100644 --- a/includes/functions.php +++ b/includes/functions.php @@ -6529,12 +6529,12 @@ function isSecure() { || $_SERVER['SERVER_PORT'] == 443; } -function sendCookie($name, $value, $expiration=0, $sensitive=true) { - $path = ''; +function sendCookie($name, $value, $expiration=0, $path='', $sensitive=true) { $domain = ''; + $httpOnly = true; // don't allow JS access to cookies. // If sensitive and HTTPS is supported, set secure to true $secure = $sensitive && isSecure(); - SetCookie ( $name, $value, $expiration, $path, $domain, $secure, false); + SetCookie ( $name, $value, $expiration, $path, $domain, $secure, $httpOnly); } ?> diff --git a/includes/js/util.js b/includes/js/util.js index 3bd96a0bf..716ffe75e 100644 --- a/includes/js/util.js +++ b/includes/js/util.js @@ -219,39 +219,4 @@ function showResponse(originalRequest) { document.body.style.cursor = 'default'; } -function altrows() { - if( ! document.getElementsByTagName ) - return false; - var rows = $$( 'div tbody tr' ); - for ( var i = 0; i < rows.length; i++ ) { - if ( ! rows[i].hasClassName( 'ignore' ) ) { - rows[i].onmouseover = function() { $( this ).addClassName( 'alt' ); } - rows[i].onmouseout = function() { $( this ).removeClassName( 'alt' ); } - } - } -} - -function altps() { - if( ! document.getElementsByTagName ) - return false; - - var rows = $$( 'div p' ); - for( var i = 0; i < rows.length; i++ ) { - if ( ! rows[i].hasClassName( 'ignore' ) ) { - rows[i].onmouseover = function() { $( this ).addClassName( 'alt' ); } - rows[i].onmouseout = function() { $( this ).removeClassName( 'alt' ); } - } - } -} -function showFrame(foo,f,section) { - document.getElementById(foo).style.display = "block"; - if (f) { setCookie(foo, "o", section); } -} - -function hideFrame(foo,f,section) { - if (document.getElementById(foo)) { - document.getElementById(foo).style.display = "none"; - if (f) { deleteCookie(foo, section); } - } -} \ No newline at end of file diff --git a/remotes.php b/remotes.php deleted file mode 100644 index 27132b0d0..000000000 --- a/remotes.php +++ /dev/null @@ -1,43 +0,0 @@ -'; - -if ( ! $NONUSER_PREFIX ) { - echo print_error_header() . translate ( 'NONUSER_PREFIX not set' ) . ' - -'; - exit; -} -$add = getValue ( 'add' ); -echo ' - - '; -?>
{$id_display}
- - {$requiredStr} -