check CSRF token enabling/disabling extensions. fixes #3559

dokuwiki · Dec 8, 2021 · 96f679f · 96f679f
1 parent b43eead
commit 96f679f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 5 deletions.
diff --git a/lib/plugins/extension/action.php b/lib/plugins/extension/action.php
@@ -57,8 +57,13 @@ public function info(Doku_Event $event, $param)
         switch ($act) {
             case 'enable':
             case 'disable':
-                $extension->$act(); //enables/disables
+                if(getSecurityToken() != $INPUT->str('sectok')) {
+                    http_status(403);
+                    echo 'Security Token did not match. Possible CSRF attack.';
+                    return;
+                }
 
+                $extension->$act(); //enables/disables
                 $reverse = ($act == 'disable') ? 'enable' : 'disable';
 
                 $return = array(

diff --git a/lib/plugins/extension/script.js b/lib/plugins/extension/script.js
@@ -64,8 +64,9 @@ jQuery(function(){
             DOKU_BASE + 'lib/exe/ajax.php',
             {
                 call: 'plugin_extension',
-                ext:  extension,
-                act:  act
+                ext: extension,
+                act: act,
+                sectok: $btn.parents('form').find('input[name=sectok]').val()
             },
             function (data) {
                 $btn.css('cursor', '')
@@ -74,12 +75,15 @@ jQuery(function(){
                     .removeClass('enable')
                     .text(data.label)
                     .addClass(data.reverse)
-                .parents('li')
+                    .parents('li')
                     .removeClass('disabled')
                     .removeClass('enabled')
                     .addClass(data.state);
             }
-        );
+        ).fail(function() {
+            $btn.css('cursor', '')
+                .removeAttr('disabled');
+        });
     });
 
     /**