Prevent Cross-Site Request Forgery

erikdubbelboer · Aug 26, 2021 · b9039ad · krzyko · Sep 7, 2021 · b9039ad
1 parent 51c5425
commit b9039ad
Show file tree

Hide file tree

Showing 7 changed files with 24 additions and 0 deletions.
diff --git a/edit.php b/edit.php
@@ -145,6 +145,7 @@
 ?>
 <h2><?php echo $edit ? 'Edit' : 'Add'?></h2>
 <form action="<?php echo format_html(getRelativePath('edit.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="type">Type:</label>

diff --git a/export.php b/export.php
@@ -187,6 +187,7 @@ function export_json($key) {
 <h2>Export <?php echo isset($_GET['key']) ? format_html($_GET['key']) : ''?></h2>
 
 <form action="<?php echo format_html(getRelativePath('export.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="type">Type:</label>

diff --git a/import.php b/import.php
@@ -92,6 +92,7 @@
 ?>
 <h2>Import</h2>
 <form action="<?php echo format_html(getRelativePath('import.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="commands">Commands:<br>

diff --git a/includes/common.inc.php b/includes/common.inc.php
@@ -4,6 +4,24 @@
 define('PHPREDIS_ADMIN_PATH', dirname(__DIR__));
 
 
+if (session_status() !== PHP_SESSION_DISABLED) {
+  session_start();
+
+  if (isset($_SESSION['phpredisadmin_csrf'])) {
+    $csrfToken = $_SESSION['phpredisadmin_csrf'];
+  } else {
+    $csrfToken = bin2hex(random_bytes(16));
+    $_SESSION['phpredisadmin_csrf'] = $csrfToken;
+  }
+} else {
+  $csrfToken = 'nosession';
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+  if ($_POST['csrf'] !== $csrfToken) {
+    die('bad csrf token');
+  }
+}
 
 
 // These includes are needed by each script.

diff --git a/login.php b/login.php
@@ -13,6 +13,7 @@
 <h1 class="logo">phpRedisAdmin</h1>
 
 <form class="form-signin" method="post" action="login.php">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
     <h2 class="form-signin-heading">Please log in</h2>
 
     <?php if (isset($_POST['username']) || isset($_POST['password'])): ?>

diff --git a/rename.php b/rename.php
@@ -36,6 +36,7 @@
 ?>
 <h2>Edit Name of <?php echo format_html($_GET['key'])?></h2>
 <form action="<?php echo format_html(getRelativePath('rename.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <input type="hidden" name="old" value="<?php echo format_html($_GET['key'])?>">
 

diff --git a/ttl.php b/ttl.php
@@ -27,6 +27,7 @@
 ?>
 <h2>Edit TTL</h2>
 <form action="<?php echo format_html(getRelativePath('ttl.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="key">Key:</label>