diff --git a/CHANGELOG b/CHANGELOG index 0c4e93f82..f5a572210 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -192,6 +192,7 @@ meta data - fix potential clickjacking attack with manipulated email address of a user - loading more items on ViewFolder page obeys sort order +- fix possible csrf attacks due to missing form token -------------------------------------------------------------------------------- Changes in version 5.1.21 diff --git a/op/op.AddDocumentLink.php b/op/op.AddDocumentLink.php index 34220b319..15ddbef63 100644 --- a/op/op.AddDocumentLink.php +++ b/op/op.AddDocumentLink.php @@ -28,6 +28,11 @@ include("../inc/inc.DBInit.php"); include("../inc/inc.ClassUI.php"); include("../inc/inc.Authentication.php"); +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('adddocumentlink', 'GET')) { + UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) { UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); } diff --git a/op/op.AddEvent.php b/op/op.AddEvent.php index b5ce57a54..84a83da65 100644 --- a/op/op.AddEvent.php +++ b/op/op.AddEvent.php @@ -34,6 +34,11 @@ if ($user->isGuest()) { UI::exitError(getMLText("edit_event"),getMLText("access_denied")); } +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('addevent')) { + UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_POST["from"]) && !(isset($_POST["frommonth"]) && isset($_POST["fromday"]) && isset($_POST["fromyear"])) ) { UI::exitError(getMLText("add_event"),getMLText("error_occured")); } diff --git a/op/op.ChangePassword.php b/op/op.ChangePassword.php index d481dd129..f2c9aa5ca 100644 --- a/op/op.ChangePassword.php +++ b/op/op.ChangePassword.php @@ -38,6 +38,11 @@ function _printMessage($heading, $message) { return; } +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('changepassword')) { + UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (isset($_POST["hash"])) { $hash = $_POST["hash"]; } diff --git a/op/op.EditDocument.php b/op/op.EditDocument.php index 44e4556a1..f2b7ab6e3 100644 --- a/op/op.EditDocument.php +++ b/op/op.EditDocument.php @@ -32,6 +32,11 @@ include("../inc/inc.Authentication.php"); $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME'])); $controller = Controller::factory($tmp[1], array('dms'=>$dms, 'user'=>$user)); +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('editdocument')) { + UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) { UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); } diff --git a/op/op.EditFolder.php b/op/op.EditFolder.php index ea2c61510..b064e458a 100644 --- a/op/op.EditFolder.php +++ b/op/op.EditFolder.php @@ -32,6 +32,11 @@ include("../inc/inc.Authentication.php"); $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME'])); $controller = Controller::factory($tmp[1], array('dms'=>$dms, 'user'=>$user)); +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('editfolder')) { + UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_POST["folderid"]) || !is_numeric($_POST["folderid"]) || intval($_POST["folderid"])<1) { UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id")); } diff --git a/op/op.EditUserData.php b/op/op.EditUserData.php index 08385c97b..e72028156 100644 --- a/op/op.EditUserData.php +++ b/op/op.EditUserData.php @@ -37,6 +37,11 @@ if (!$user->isAdmin() && ($settings->_disableSelfEdit)) { UI::exitError(getMLText("edit_user_details"),getMLText("access_denied")); } +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('edituserdata')) { + UI::exitError(getMLText("edit_user_details"),getMLText("invalid_request_token")); +} + $fullname = $_POST["fullname"]; $email = $_POST["email"]; $comment = $_POST["comment"]; diff --git a/op/op.MoveDocument.php b/op/op.MoveDocument.php index 54a93683f..d62e349d2 100644 --- a/op/op.MoveDocument.php +++ b/op/op.MoveDocument.php @@ -20,6 +20,7 @@ include("../inc/inc.Settings.php"); include("../inc/inc.LogInit.php"); +include("../inc/inc.Utils.php"); include("../inc/inc.Language.php"); include("../inc/inc.Init.php"); include("../inc/inc.Extension.php"); @@ -27,6 +28,11 @@ include("../inc/inc.DBInit.php"); include("../inc/inc.ClassUI.php"); include("../inc/inc.Authentication.php"); +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('movedocument', 'GET')) { + UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) { UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); } @@ -62,46 +68,48 @@ if($document->isLocked()) { } } +if ($targetid == $oldFolder->getID()) { + UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("target_equals_source_folder")); +} + /* Check if name already exists in the folder */ if(!$settings->_enableDuplicateDocNames) { if($targetFolder->hasDocumentByName($document->getName())) { - UI::exitError(getMLText("folder_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("document_duplicate_name")); + UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("document_duplicate_name")); } } -if ($targetid != $oldFolder->getID()) { - if ($document->setFolder($targetFolder)) { - // Send notification to subscribers. - if($notifier) { - $nl1 = $oldFolder->getNotifyList(); - $nl2 = $document->getNotifyList(); - $nl3 = $targetFolder->getNotifyList(); - $nl = array( - 'users'=>array_unique(array_merge($nl1['users'], $nl2['users'], $nl3['users']), SORT_REGULAR), - 'groups'=>array_unique(array_merge($nl1['groups'], $nl2['groups'], $nl3['groups']), SORT_REGULAR) - ); - $subject = "document_moved_email_subject"; - $message = "document_moved_email_body"; - $params = array(); - $params['name'] = $document->getName(); - $params['old_folder_path'] = $oldFolder->getFolderPathPlain(); - $params['new_folder_path'] = $targetFolder->getFolderPathPlain(); - $params['username'] = $user->getFullName(); - $params['url'] = getBaseUrl().$settings->_httpRoot."out/out.ViewDocument.php?documentid=".$document->getID(); - $params['sitename'] = $settings->_siteName; - $params['http_root'] = $settings->_httpRoot; - $notifier->toList($user, $nl["users"], $subject, $message, $params); - foreach ($nl["groups"] as $grp) { - $notifier->toGroup($user, $grp, $subject, $message, $params); - } - // if user is not owner send notification to owner +if ($document->setFolder($targetFolder)) { + // Send notification to subscribers. + if($notifier) { + $nl1 = $oldFolder->getNotifyList(); + $nl2 = $document->getNotifyList(); + $nl3 = $targetFolder->getNotifyList(); + $nl = array( + 'users'=>array_unique(array_merge($nl1['users'], $nl2['users'], $nl3['users']), SORT_REGULAR), + 'groups'=>array_unique(array_merge($nl1['groups'], $nl2['groups'], $nl3['groups']), SORT_REGULAR) + ); + $subject = "document_moved_email_subject"; + $message = "document_moved_email_body"; + $params = array(); + $params['name'] = $document->getName(); + $params['old_folder_path'] = $oldFolder->getFolderPathPlain(); + $params['new_folder_path'] = $targetFolder->getFolderPathPlain(); + $params['username'] = $user->getFullName(); + $params['url'] = getBaseUrl().$settings->_httpRoot."out/out.ViewDocument.php?documentid=".$document->getID(); + $params['sitename'] = $settings->_siteName; + $params['http_root'] = $settings->_httpRoot; + $notifier->toList($user, $nl["users"], $subject, $message, $params); + foreach ($nl["groups"] as $grp) { + $notifier->toGroup($user, $grp, $subject, $message, $params); + } + // if user is not owner send notification to owner // if ($user->getID() != $document->getOwner()->getID()) // $notifier->toIndividual($user, $document->getOwner(), $subject, $message, $params); - } - - } else { - UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("error_occured")); } + +} else { + UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("error_occured")); } add_log_line(); diff --git a/op/op.MoveFolder.php b/op/op.MoveFolder.php index 84090c704..31c77a6c8 100644 --- a/op/op.MoveFolder.php +++ b/op/op.MoveFolder.php @@ -20,6 +20,7 @@ include("../inc/inc.Settings.php"); include("../inc/inc.LogInit.php"); +include("../inc/inc.Utils.php"); include("../inc/inc.Language.php"); include("../inc/inc.Init.php"); include("../inc/inc.Extension.php"); @@ -27,6 +28,11 @@ include("../inc/inc.DBInit.php"); include("../inc/inc.ClassUI.php"); include("../inc/inc.Authentication.php"); +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('movefolder', 'GET')) { + UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) { UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id")); } @@ -52,6 +58,11 @@ if (!is_object($targetFolder)) { UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id")); } +$oldFolder = $folder->getParent(); +if ($targetid == $oldFolder->getID()) { + UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("target_equals_source_folder")); +} + if($folder->isSubFolder($targetFolder)) { UI::exitError(getMLText("folder_title", array("foldername" => $folder->getName())),getMLText("invalid_target_folder")); } @@ -67,7 +78,6 @@ if(!$settings->_enableDuplicateSubFolderNames) { } } -$oldFolder = $folder->getParent(); if ($folder->setParent($targetFolder)) { // Send notification to subscribers. if($notifier) { diff --git a/op/op.OverrideContentStatus.php b/op/op.OverrideContentStatus.php index b94725260..8778505a7 100644 --- a/op/op.OverrideContentStatus.php +++ b/op/op.OverrideContentStatus.php @@ -34,6 +34,12 @@ $accessop = new SeedDMS_AccessOperation($dms, $user, $settings); if(!$accessop->check_controller_access($tmp[1] /*$controller*/)) { UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("access_denied")); } + +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('overridecontentstatus')) { + UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) { UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); } diff --git a/op/op.SetExpires.php b/op/op.SetExpires.php index 8dc626487..5efd3eee6 100644 --- a/op/op.SetExpires.php +++ b/op/op.SetExpires.php @@ -28,6 +28,11 @@ include("../inc/inc.DBInit.php"); include("../inc/inc.ClassUI.php"); include("../inc/inc.Authentication.php"); +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('setexpires')) { + UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) { UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); } diff --git a/op/op.Settings.php b/op/op.Settings.php index 50be8fb66..865bb2b69 100644 --- a/op/op.Settings.php +++ b/op/op.Settings.php @@ -44,6 +44,11 @@ if (!$user->isAdmin()) { UI::exitError(getMLText("admin_tools"),getMLText("access_denied")); } +/* Check if the form data comes from a trusted request */ +if(!checkFormKey('savesettings')) { + UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token")); +} + if (isset($_POST["action"])) $action=$_POST["action"]; else if (isset($_GET["action"])) $action=$_GET["action"]; else $action=NULL; diff --git a/views/bootstrap/class.AddEvent.php b/views/bootstrap/class.AddEvent.php index ec8a62e36..65d32b90e 100644 --- a/views/bootstrap/class.AddEvent.php +++ b/views/bootstrap/class.AddEvent.php @@ -84,6 +84,7 @@ $(document).ready(function() { ?>
+ formField( diff --git a/views/bootstrap/class.Bootstrap.php b/views/bootstrap/class.Bootstrap.php index e79968b1e..e9402dd28 100644 --- a/views/bootstrap/class.Bootstrap.php +++ b/views/bootstrap/class.Bootstrap.php @@ -2486,6 +2486,21 @@ $(function() { return ''; } /* }}} */ + function printAccessButton($object, $return=false) { /* {{{ */ + $content = ''; + $objid = $object->getId(); + if($object->isType('document')) { + $content .= ''; + } elseif($object->isType('folder')) { + $content .= ''; + } + if($return) + return $content; + else + echo $content; + return ''; + } /* }}} */ + /** * Output left-arrow with link which takes over a number of ids into * a select box. @@ -2936,6 +2951,9 @@ $('body').on('click', '[id^=\"table-row-folder\"] td:nth-child(2)', function(ev) if($document->getAccessMode($user) >= M_READWRITE) { $content .= $this->printLockButton($document, 'splash_document_locked', 'splash_document_unlocked', true); } + if($document->getAccessMode($user) >= M_READWRITE) { + $content .= $this->printAccessButton($document, true); + } if($enableClipboard) { $content .= ''; } @@ -3065,6 +3083,9 @@ $('body').on('click', '[id^=\"table-row-folder\"] td:nth-child(2)', function(ev) } else { $content .= ''; } + if($subFolderAccessMode >= M_READWRITE) { + $content .= $this->printAccessButton($subFolder, true); + } if($enableClipboard) { $content .= ''; } diff --git a/views/bootstrap/class.ChangePassword.php b/views/bootstrap/class.ChangePassword.php index 92684195e..41e4b4e5b 100644 --- a/views/bootstrap/class.ChangePassword.php +++ b/views/bootstrap/class.ChangePassword.php @@ -51,6 +51,7 @@ document.form1.newpassword.focus(); $this->contentContainerStart(); ?> + "; diff --git a/views/bootstrap/class.EditDocument.php b/views/bootstrap/class.EditDocument.php index c94c1c356..42d492f85 100644 --- a/views/bootstrap/class.EditDocument.php +++ b/views/bootstrap/class.EditDocument.php @@ -90,6 +90,7 @@ $(document).ready( function() { $expdate = ''; ?> + formField( diff --git a/views/bootstrap/class.EditFolder.php b/views/bootstrap/class.EditFolder.php index 9cf48d6e5..05370ad49 100644 --- a/views/bootstrap/class.EditFolder.php +++ b/views/bootstrap/class.EditFolder.php @@ -81,6 +81,7 @@ $(document).ready(function() { $this->contentContainerStart(); ?> + contentContainerStart(); ?> + formField( getMLText("current_password"), diff --git a/views/bootstrap/class.ForcePasswordChange.php b/views/bootstrap/class.ForcePasswordChange.php index 06553cf4e..02ef8f122 100644 --- a/views/bootstrap/class.ForcePasswordChange.php +++ b/views/bootstrap/class.ForcePasswordChange.php @@ -77,31 +77,42 @@ $(document).ready( function() { echo "
".getMLText('password_expiration_text')."
"; $this->contentContainerStart(); ?> - - - - - - - - - - - - - - - - - - - - - - -
:
:
: -
-
:
">
+ + +formField( + getMLText("current_password"), + array( + 'element'=>'input', + 'type'=>'password', + 'id'=>'currentpwd', + 'name'=>'currentpwd', + 'autocomplete'=>'off', + 'required'=>true + ) + ); + $this->formField( + getMLText("new_password"), + '' + ); + if($passwordstrength) { + $this->formField( + getMLText("password_strength"), + '
' + ); + } + $this->formField( + getMLText("confirm_pwd"), + array( + 'element'=>'input', + 'type'=>'password', + 'id'=>'pwdconf', + 'name'=>'pwdconf', + 'autocomplete'=>'off', + ) + ); + $this->formSubmit(" ".getMLText('submit_password')); +?> diff --git a/views/bootstrap/class.MoveDocument.php b/views/bootstrap/class.MoveDocument.php index 8862db301..66502bf23 100644 --- a/views/bootstrap/class.MoveDocument.php +++ b/views/bootstrap/class.MoveDocument.php @@ -52,6 +52,7 @@ class SeedDMS_View_MoveDocument extends SeedDMS_Bootstrap_Style { $this->contentContainerStart('warning'); ?> + formField(getMLText("choose_target_folder"), $this->getFolderChooserHtml("form1", M_READWRITE, -1, $target)); diff --git a/views/bootstrap/class.MoveFolder.php b/views/bootstrap/class.MoveFolder.php index f9091fe31..f990ae3a8 100644 --- a/views/bootstrap/class.MoveFolder.php +++ b/views/bootstrap/class.MoveFolder.php @@ -52,6 +52,7 @@ class SeedDMS_View_MoveFolder extends SeedDMS_Bootstrap_Style { ?> + + + + + formField(getMLText("add_document_link"), $this->getDocumentChooserHtml("form1")); ?> getAccessMode($user) >= M_READWRITE) {