[pLog-svn] r6083 - in plog/trunk: class/action/admin class/data class/data/validator templates/admin

Reto Hugi plog at hugi.to
Wed Nov 28 12:01:45 EST 2007


weekend, not week. But yes, please go ahead, I already thought i may be 
a bit late. that's why I mentioned it. I'm away the next 3 evenings...

Mark Wu wrote:
> Hi Reto:
> 
> Next week? Then, it is not good. :P
> 
> If you allowed, I will create a branch for you , and revert the trunk and
> move your commits code there.
> 
> Regards, Mark
>  
> 
>> -----Original Message-----
>> From: plog-svn-bounces at devel.lifetype.net 
>> [mailto:plog-svn-bounces at devel.lifetype.net] On Behalf Of Reto Hugi
>> Sent: Wednesday, November 28, 2007 6:08 AM
>> To: LifeType Developer List
>> Subject: Re: [pLog-svn] r6083 - in plog/trunk: 
>> class/action/admin class/data class/data/validator templates/admin
>>
>> ok, I'll do that asap. where asap may be next weekend :)
>>
>> On 11/27/2007 10:36 PM, Oscar Renalias wrote:
>>> Looks interesting, but how about we move it to its own branch (from
>>> 'trunk') for the time being? At least until we agree on an 
>>> implementation and see that it really works.
>>>
>>> You can go ahead and create the branch yourself, if you agree :)
>>>
>>> Oscar
>>>
>>> On Nov 27, 2007, at 11:05 PM, reto at devel.lifetype.net wrote:
>>>
>>>> Author: reto
>>>> Date: 2007-11-27 16:05:57 -0500 (Tue, 27 Nov 2007) New 
>> Revision: 6083
>>>> Added:
>>>>   plog/trunk/class/data/nonce.class.php
>>>>   plog/trunk/class/data/validator/noncevalidator.class.php
>>>> Modified:
>>>>   plog/trunk/class/action/admin/adminaction.class.php
>>>>   plog/trunk/class/action/admin/admindeletepostaction.class.php
>>>>   plog/trunk/templates/admin/editposts.template
>>>> Log:
>>>> First PoC implementation for CSRF protection:
>>>> - nonce.class.php does nothing but generating nonces. Note: the 
>>>> randomizer is quite simple and but I'm not sure if there 
>> is need for 
>>>> some more complex (and time consuming) nonce generation.
>>>>
>>>> - noncevalidator compares the nonce in the request with 
>> the nonce in 
>>>> the session
>>>>
>>>> - adminaction stores a new nonce to the users session each 
>> time the 
>>>> method setCommonData is called (this deletes any previously set 
>>>> nonces after validation)
>>>>
>>>> limitations:
>>>> - it doesn't work with javascript enabled ATM.
>>>> - it doesn't work with GET requests (i.e. klicks on the 
>> delete icons)
>>>> - only works on the deletepostaction
>>>>
>>>>
>>>>
>>>> Modified: plog/trunk/class/action/admin/adminaction.class.php
>>>> ===================================================================
>>>> --- plog/trunk/class/action/admin/adminaction.class.php	
>> 2007-11-27  
>>>> 20:56:55 UTC (rev 6082)
>>>> +++ plog/trunk/class/action/admin/adminaction.class.php	
>> 2007-11-27  
>>>> 21:05:57 UTC (rev 6083)
>>>> @@ -1,7 +1,8 @@
>>>> <?php
>>>>
>>>> 	lt_include( PLOG_CLASS_PATH."class/dao/blogstatus.class.php" );	
>>>> -
>>>> +    lt_include( PLOG_CLASS_PATH."class/data/nonce.class.php" );
>>>> +
>>>> 	/**
>>>> 	 * @see AdminAction::requirePermission()
>>>> 	 */
>>>> @@ -34,6 +35,7 @@
>>>> 		var $_pm;
>>>> 		var $_userBlogs;
>>>> 		var $_permissions;
>>>> +		var $_nonce;
>>>>
>>>>         /**
>>>>          * Constructor.
>>>> @@ -167,6 +169,14 @@
>>>>             $this->_view->setValue( "op", $this->_actionInfo-
>>>>> _actionParamValue );
>>>> 			$this->_view->setValue( "locale", 
>> $this->_locale );
>>>> 			$this->_view->setValue( "config", 
>> $this->_config );
>>>> +			
>>>> +			
>>>> +            //let's create a nonce to protect against CSRF
>>>> +            $nonce = new Nonce();
>>>> +            $this->_nonce = $nonce->getNonce();
>>>> +            $this->_session->setValue('nonce',$this->_nonce);
>>>> +			
>>>> +			$this->_view->setValue( "nonce", 
>> $this->_nonce );
>>>>         }
>>>>
>>>>         /**
>>>> @@ -338,4 +348,4 @@
>>>> 			return( $view );
>>>> 		}		
>>>>     }
>>>> -?>
>>>> \ No newline at end of file
>>>> +?>
>>>>
>>>> Modified: plog/trunk/class/action/admin/ 
>>>> admindeletepostaction.class.php 
>>>> ===================================================================
>>>> --- 
>> plog/trunk/class/action/admin/admindeletepostaction.class.php	 
>>>> 2007-11-27 20:56:55 UTC (rev 6082)
>>>> +++ 
>> plog/trunk/class/action/admin/admindeletepostaction.class.php	 
>>>> 2007-11-27 21:05:57 UTC (rev 6083)
>>>> @@ -26,6 +26,8 @@
>>>> 			else
>>>> 				$this->registerFieldValidator( 
>> "postIds", new ArrayValidator( new 
>>>> IntegerValidator()));
>>>>
>>>> +            $this->registerFieldValidator( "nonce", new
>>>> NonceValidator() );
>>>> +
>>>> 			$view = new AdminPostsListView( 
>> $this->_blogInfo );
>>>> 			$view->setErrorMessage( $this->_locale-
>>>>> tr("error_incorrect_article_id"));
>>>> 			$this->setValidationErrorView( $view );	
>>>> @@ -33,6 +35,18 @@
>>>> 			$this->requirePermission( "update_post" );	
>>>>         }
>>>>
>>>> +		/**
>>>> +         *
>>>> +		 */
>>>> +		/*function validate()
>>>> +		{
>>>> +			$nonceValidator = new NonceValidator();
>>>> +			
>>>> +			if( !$nonceValidator->validate( $this->_request-
>>>>> getValue( "nonce" ) ) )
>>>> +                return false;
>>>> +		}*/
>>>> +
>>>> +
>>>>         /**
>>>>          * Carries out the specified action
>>>>          */
>>>> @@ -133,4 +147,4 @@
>>>> 	        return true;
>>>> 		}
>>>>     }
>>>> -?>
>>>> \ No newline at end of file
>>>> +?>
>>>>
>>>> Added: plog/trunk/class/data/nonce.class.php
>>>> ===================================================================
>>>> --- plog/trunk/class/data/nonce.class.php	                
>>          
>>>> (rev 0)
>>>> +++ plog/trunk/class/data/nonce.class.php	2007-11-27 
>> 21:05:57 UTC  
>>>> (rev 6083)
>>>> @@ -0,0 +1,42 @@
>>>> +<?php
>>>> +	/**
>>>> +	 * \ingroup Data
>>>> +	 *	
>>>> +	 * Class to generate random nonces to protect from CSRF attacks.
>>>> +	 *
>>>> +	 */
>>>> +	class Nonce
>>>> +	{
>>>> +		var $_nonce = '';
>>>> +		
>>>> +		/**
>>>> +		 * Constructor.
>>>> +		 */
>>>> +		function Nonce()
>>>> +		{
>>>> +			$this->_nonce = $this->create();
>>>> +
>>>> +		}
>>>> +		
>>>> +		
>>>> +		/**
>>>> +		 * generates a new nonce
>>>> +		 *
>>>> +		 * @return a reasonably enough random string
>>>> +		 */
>>>> +		function create()
>>>> +		{
>>>> +
>>>> +            $nonce = md5(time().rand(1000,9999));
>>>> +			return( $nonce );
>>>> +
>>>> +		}
>>>> +		
>>>> +		function getNonce()
>>>> +		{
>>>> +            		return $this->_nonce;
>>>> +		}
>>>> +
>>>> +
>>>> +	}
>>>> +?>
>>>>
>>>> Added: plog/trunk/class/data/validator/noncevalidator.class.php
>>>> ===================================================================
>>>> --- plog/trunk/class/data/validator/ 
>>>> noncevalidator.class.php	                        (rev 0)
>>>> +++ 
>> plog/trunk/class/data/validator/noncevalidator.class.php	 
>>>> 2007-11-27 21:05:57 UTC (rev 6083)
>>>> @@ -0,0 +1,41 @@
>>>> +<?php
>>>> +
>>>> +
>>>> +
>>>> +    /**
>>>> +     * \ingroup Validator
>>>> +     *
>>>> +     * Validates nonces protecting sensitive actions from CSRF:
>>>> +     *
>>>> +     *
>>>> +     */
>>>> +    class NonceValidator extends Validator
>>>> +    {
>>>> +    	function NonceValidator()
>>>> +        {
>>>> +        	$this->Validator();
>>>> +        }
>>>> +
>>>> +
>>>> +        function validate($requestNonce)
>>>> +        {
>>>> +            $log = LoggerManager::getLogger( "debug" );
>>>> +
>>>> +            // get the session nonce
>>>> +            $session = HttpVars::getSession();
>>>> +            $this->_session = $session["SessionInfo"];
>>>> +            $sessionNonce = $this->_session->getValue('nonce');
>>>> +
>>>> +            $log->info('request: '. $requestNonce);
>>>> +            $log->info('session: '. $sessionNonce);
>>>> +
>>>> +            if ($requestNonce === $sessionNonce) {
>>>> +                return true;
>>>> +            }
>>>> +            else {
>>>> +                return false;
>>>> +            }
>>>> +
>>>> +        }
>>>> +    }
>>>> +?>
>>>>
>>>> Modified: plog/trunk/templates/admin/editposts.template
>>>> ===================================================================
>>>> --- plog/trunk/templates/admin/editposts.template	2007-11-27  
>>>> 20:56:55 UTC (rev 6082)
>>>> +++ plog/trunk/templates/admin/editposts.template	2007-11-27  
>>>> 21:05:57 UTC (rev 6083)
>>>> @@ -120,6 +120,7 @@
>>>>         <a name="bulkEdit"></a>
>>>>         <div id="list_action_bar">
>>>> 			{check_perms perm=update_post}
>>>> +            <input type="hidden" name="nonce" value="{$nonce}" />
>>>>             <input type="submit" name="delete" value="{$locale-
>>>>> tr("delete")}" class="submit" />
>>>>             <input type="hidden" name="op" value="deletePosts" />
>>>> 			{/check_perms}
>>>>
>>>> _______________________________________________
>>>> pLog-svn mailing list
>>>> pLog-svn at devel.lifetype.net
>>>> http://limedaley.com/mailman/listinfo/plog-svn
>>> _______________________________________________
>>> pLog-svn mailing list
>>> pLog-svn at devel.lifetype.net
>>> http://limedaley.com/mailman/listinfo/plog-svn
>> _______________________________________________
>> pLog-svn mailing list
>> pLog-svn at devel.lifetype.net
>> http://limedaley.com/mailman/listinfo/plog-svn
> 



More information about the pLog-svn mailing list