[pLog-svn] r6083 - in plog/trunk: class/action/admin class/data class/data/validator templates/admin
Reto Hugi
plog at hugi.to
Tue Nov 27 17:08:25 EST 2007
ok, I'll do that asap. where asap may be next weekend :)
On 11/27/2007 10:36 PM, Oscar Renalias wrote:
> Looks interesting, but how about we move it to its own branch (from
> 'trunk') for the time being? At least until we agree on an
> implementation and see that it really works.
>
> You can go ahead and create the branch yourself, if you agree :)
>
> Oscar
>
> On Nov 27, 2007, at 11:05 PM, reto at devel.lifetype.net wrote:
>
>> Author: reto
>> Date: 2007-11-27 16:05:57 -0500 (Tue, 27 Nov 2007)
>> New Revision: 6083
>>
>> Added:
>> plog/trunk/class/data/nonce.class.php
>> plog/trunk/class/data/validator/noncevalidator.class.php
>> Modified:
>> plog/trunk/class/action/admin/adminaction.class.php
>> plog/trunk/class/action/admin/admindeletepostaction.class.php
>> plog/trunk/templates/admin/editposts.template
>> Log:
>> First PoC implementation for CSRF protection:
>> - nonce.class.php does nothing but generating nonces. Note: the
>> randomizer is quite simple and but I'm not sure if there is need for
>> some more complex (and time consuming) nonce generation.
>>
>> - noncevalidator compares the nonce in the request with the nonce in
>> the session
>>
>> - adminaction stores a new nonce to the users session each time the
>> method setCommonData is called (this deletes any previously set
>> nonces after validation)
>>
>> limitations:
>> - it doesn't work with javascript enabled ATM.
>> - it doesn't work with GET requests (i.e. klicks on the delete icons)
>> - only works on the deletepostaction
>>
>>
>>
>> Modified: plog/trunk/class/action/admin/adminaction.class.php
>> ===================================================================
>> --- plog/trunk/class/action/admin/adminaction.class.php 2007-11-27
>> 20:56:55 UTC (rev 6082)
>> +++ plog/trunk/class/action/admin/adminaction.class.php 2007-11-27
>> 21:05:57 UTC (rev 6083)
>> @@ -1,7 +1,8 @@
>> <?php
>>
>> lt_include( PLOG_CLASS_PATH."class/dao/blogstatus.class.php" );
>> -
>> + lt_include( PLOG_CLASS_PATH."class/data/nonce.class.php" );
>> +
>> /**
>> * @see AdminAction::requirePermission()
>> */
>> @@ -34,6 +35,7 @@
>> var $_pm;
>> var $_userBlogs;
>> var $_permissions;
>> + var $_nonce;
>>
>> /**
>> * Constructor.
>> @@ -167,6 +169,14 @@
>> $this->_view->setValue( "op", $this->_actionInfo-
>> >_actionParamValue );
>> $this->_view->setValue( "locale", $this->_locale );
>> $this->_view->setValue( "config", $this->_config );
>> +
>> +
>> + //let's create a nonce to protect against CSRF
>> + $nonce = new Nonce();
>> + $this->_nonce = $nonce->getNonce();
>> + $this->_session->setValue('nonce',$this->_nonce);
>> +
>> + $this->_view->setValue( "nonce", $this->_nonce );
>> }
>>
>> /**
>> @@ -338,4 +348,4 @@
>> return( $view );
>> }
>> }
>> -?>
>> \ No newline at end of file
>> +?>
>>
>> Modified: plog/trunk/class/action/admin/
>> admindeletepostaction.class.php
>> ===================================================================
>> --- plog/trunk/class/action/admin/admindeletepostaction.class.php
>> 2007-11-27 20:56:55 UTC (rev 6082)
>> +++ plog/trunk/class/action/admin/admindeletepostaction.class.php
>> 2007-11-27 21:05:57 UTC (rev 6083)
>> @@ -26,6 +26,8 @@
>> else
>> $this->registerFieldValidator( "postIds", new
>> ArrayValidator( new IntegerValidator()));
>>
>> + $this->registerFieldValidator( "nonce", new
>> NonceValidator() );
>> +
>> $view = new AdminPostsListView( $this->_blogInfo );
>> $view->setErrorMessage( $this->_locale-
>> >tr("error_incorrect_article_id"));
>> $this->setValidationErrorView( $view );
>> @@ -33,6 +35,18 @@
>> $this->requirePermission( "update_post" );
>> }
>>
>> + /**
>> + *
>> + */
>> + /*function validate()
>> + {
>> + $nonceValidator = new NonceValidator();
>> +
>> + if( !$nonceValidator->validate( $this->_request-
>> >getValue( "nonce" ) ) )
>> + return false;
>> + }*/
>> +
>> +
>> /**
>> * Carries out the specified action
>> */
>> @@ -133,4 +147,4 @@
>> return true;
>> }
>> }
>> -?>
>> \ No newline at end of file
>> +?>
>>
>> Added: plog/trunk/class/data/nonce.class.php
>> ===================================================================
>> --- plog/trunk/class/data/nonce.class.php
>> (rev 0)
>> +++ plog/trunk/class/data/nonce.class.php 2007-11-27 21:05:57 UTC
>> (rev 6083)
>> @@ -0,0 +1,42 @@
>> +<?php
>> + /**
>> + * \ingroup Data
>> + *
>> + * Class to generate random nonces to protect from CSRF attacks.
>> + *
>> + */
>> + class Nonce
>> + {
>> + var $_nonce = '';
>> +
>> + /**
>> + * Constructor.
>> + */
>> + function Nonce()
>> + {
>> + $this->_nonce = $this->create();
>> +
>> + }
>> +
>> +
>> + /**
>> + * generates a new nonce
>> + *
>> + * @return a reasonably enough random string
>> + */
>> + function create()
>> + {
>> +
>> + $nonce = md5(time().rand(1000,9999));
>> + return( $nonce );
>> +
>> + }
>> +
>> + function getNonce()
>> + {
>> + return $this->_nonce;
>> + }
>> +
>> +
>> + }
>> +?>
>>
>> Added: plog/trunk/class/data/validator/noncevalidator.class.php
>> ===================================================================
>> --- plog/trunk/class/data/validator/
>> noncevalidator.class.php (rev 0)
>> +++ plog/trunk/class/data/validator/noncevalidator.class.php
>> 2007-11-27 21:05:57 UTC (rev 6083)
>> @@ -0,0 +1,41 @@
>> +<?php
>> +
>> +
>> +
>> + /**
>> + * \ingroup Validator
>> + *
>> + * Validates nonces protecting sensitive actions from CSRF:
>> + *
>> + *
>> + */
>> + class NonceValidator extends Validator
>> + {
>> + function NonceValidator()
>> + {
>> + $this->Validator();
>> + }
>> +
>> +
>> + function validate($requestNonce)
>> + {
>> + $log = LoggerManager::getLogger( "debug" );
>> +
>> + // get the session nonce
>> + $session = HttpVars::getSession();
>> + $this->_session = $session["SessionInfo"];
>> + $sessionNonce = $this->_session->getValue('nonce');
>> +
>> + $log->info('request: '. $requestNonce);
>> + $log->info('session: '. $sessionNonce);
>> +
>> + if ($requestNonce === $sessionNonce) {
>> + return true;
>> + }
>> + else {
>> + return false;
>> + }
>> +
>> + }
>> + }
>> +?>
>>
>> Modified: plog/trunk/templates/admin/editposts.template
>> ===================================================================
>> --- plog/trunk/templates/admin/editposts.template 2007-11-27
>> 20:56:55 UTC (rev 6082)
>> +++ plog/trunk/templates/admin/editposts.template 2007-11-27
>> 21:05:57 UTC (rev 6083)
>> @@ -120,6 +120,7 @@
>> <a name="bulkEdit"></a>
>> <div id="list_action_bar">
>> {check_perms perm=update_post}
>> + <input type="hidden" name="nonce" value="{$nonce}" />
>> <input type="submit" name="delete" value="{$locale-
>> >tr("delete")}" class="submit" />
>> <input type="hidden" name="op" value="deletePosts" />
>> {/check_perms}
>>
>> _______________________________________________
>> pLog-svn mailing list
>> pLog-svn at devel.lifetype.net
>> http://limedaley.com/mailman/listinfo/plog-svn
>
> _______________________________________________
> pLog-svn mailing list
> pLog-svn at devel.lifetype.net
> http://limedaley.com/mailman/listinfo/plog-svn
More information about the pLog-svn
mailing list