From dccc2a84355149c702dbd2db7e560d38b0e05c01 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sun, 7 Aug 2016 13:52:57 +0200 Subject: meta referrer origin https://github.com/FreshRSS/FreshRSS/issues/955 Tested in Firefox 48, Chrome 53, Edge 25 --- app/layout/layout.phtml | 2 ++ 1 file changed, 2 insertions(+) (limited to 'app/layout/layout.phtml') diff --git a/app/layout/layout.phtml b/app/layout/layout.phtml index 6906fa05f..7fdc01241 100644 --- a/app/layout/layout.phtml +++ b/app/layout/layout.phtml @@ -41,6 +41,8 @@ $url_rss['a'] = 'rss'; ?> +allow_referrer) { ?> + allow_robots) { ?> -- cgit v1.2.3 From a6071a0d9824908ea48099a66435d70d74b9b1b8 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Fri, 12 Aug 2016 22:56:02 +0200 Subject: PHP 5.3 compatibility for callback https://github.com/FreshRSS/FreshRSS/issues/1208 --- app/Controllers/indexController.php | 10 +++++----- app/layout/layout.phtml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) (limited to 'app/layout/layout.phtml') diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 7e626720e..2333ff69d 100755 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -32,9 +32,9 @@ class FreshRSS_index_Controller extends Minz_ActionController { Minz_Error::error(404); } - $this->view->callbackBeforeContent = function() { + $this->view->callbackBeforeContent = function($view) { try { - $entries = $this->listEntriesByContext(); + $entries = FreshRSS_index_Controller::listEntriesByContext(); $nb_entries = count($entries); if ($nb_entries > FreshRSS_Context::$number) { @@ -55,7 +55,7 @@ class FreshRSS_index_Controller extends Minz_ActionController { } } - $this->view->entries = $entries; + $view->entries = $entries; } catch (FreshRSS_EntriesGetter_Exception $e) { Minz_Log::notice($e->getMessage()); Minz_Error::error(404); @@ -132,7 +132,7 @@ class FreshRSS_index_Controller extends Minz_ActionController { } try { - $this->view->entries = $this->listEntriesByContext(); + $this->view->entries = FreshRSS_index_Controller::listEntriesByContext(); } catch (FreshRSS_EntriesGetter_Exception $e) { Minz_Log::notice($e->getMessage()); Minz_Error::error(404); @@ -189,7 +189,7 @@ class FreshRSS_index_Controller extends Minz_ActionController { /** * This method returns a list of entries based on the Context object. */ - private function listEntriesByContext() { + private static function listEntriesByContext() { $entryDAO = FreshRSS_Factory::createEntryDao(); $get = FreshRSS_Context::currentGet(true); diff --git a/app/layout/layout.phtml b/app/layout/layout.phtml index 7fdc01241..2aeba40a9 100644 --- a/app/layout/layout.phtml +++ b/app/layout/layout.phtml @@ -23,7 +23,7 @@ callbackBeforeContent)) { - call_user_func($this->callbackBeforeContent); + call_user_func($this->callbackBeforeContent, $this); } ?> -- cgit v1.2.3 From e6fd34bdda5d067a9e74714aaae10c89ed998a46 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sat, 13 Aug 2016 17:49:31 +0200 Subject: CSRF token, update HTTP Referrer policy to same-origin https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer https://github.com/FreshRSS/FreshRSS/issues/570 https://github.com/FreshRSS/FreshRSS/issues/955 https://github.com/FreshRSS/FreshRSS/issues/1198 https://github.com/FreshRSS/FreshRSS/issues/565 https://github.com/FreshRSS/FreshRSS/issues/554 --- app/FreshRSS.php | 2 +- app/Models/Auth.php | 21 +++++++++++++ app/layout/aside_feed.phtml | 1 + app/layout/layout.phtml | 2 +- app/layout/nav_menu.phtml | 1 + app/views/auth/formLogin.phtml | 1 + app/views/auth/index.phtml | 1 + app/views/auth/register.phtml | 55 +++++++++++++++++---------------- app/views/configure/archiving.phtml | 2 ++ app/views/configure/display.phtml | 1 + app/views/configure/queries.phtml | 1 + app/views/configure/reading.phtml | 1 + app/views/configure/sharing.phtml | 1 + app/views/configure/shortcut.phtml | 1 + app/views/configure/system.phtml | 1 + app/views/extension/index.phtml | 1 + app/views/feed/add.phtml | 1 + app/views/helpers/feed/update.phtml | 1 + app/views/helpers/javascript_vars.phtml | 1 + app/views/helpers/pagination.phtml | 1 + app/views/importExport/index.phtml | 2 ++ app/views/index/logs.phtml | 1 + app/views/stats/idle.phtml | 1 + app/views/subscription/index.phtml | 7 ++++- app/views/user/manage.phtml | 2 ++ app/views/user/profile.phtml | 2 ++ lib/lib_rss.php | 2 +- p/scripts/main.js | 13 ++++++-- 28 files changed, 94 insertions(+), 33 deletions(-) (limited to 'app/layout/layout.phtml') diff --git a/app/FreshRSS.php b/app/FreshRSS.php index 20640266e..f9c371d27 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -57,7 +57,7 @@ class FreshRSS extends Minz_FrontController { private static function initAuth() { FreshRSS_Auth::init(); - if (Minz_Request::isPost() && !is_referer_from_same_domain()) { + if (Minz_Request::isPost() && !(is_referer_from_same_domain() && FreshRSS_Auth::isCsrfOk())) { // Basic protection against XSRF attacks FreshRSS_Auth::removeAccess(); $http_referer = empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER']; diff --git a/app/Models/Auth.php b/app/Models/Auth.php index d689f7cdb..f0e8db5a2 100644 --- a/app/Models/Auth.php +++ b/app/Models/Auth.php @@ -124,6 +124,7 @@ class FreshRSS_Auth { self::$login_ok = false; $conf = Minz_Configuration::get('system'); Minz_Session::_param('currentUser', $conf->default_user); + Minz_Session::_param('csrf'); switch ($conf->auth_type) { case 'form': @@ -156,6 +157,26 @@ class FreshRSS_Auth { $auth_type = $conf->auth_type; return $auth_type === 'form'; } + + public static function csrfToken() { + $csrf = Minz_Session::param('csrf'); + if ($csrf == '') { + $salt = FreshRSS_Context::$system_conf->salt; + $csrf = sha1($salt . uniqid(mt_rand(), true)); + Minz_Session::_param('csrf', $csrf); + } + return $csrf; + } + public static function isCsrfOk($token = null) { + $csrf = Minz_Session::param('csrf'); + if ($csrf == '') { + return true; //Not logged in yet + } + if ($token === null) { + $token = Minz_Request::param('_csrf'); + } + return $token === $csrf; + } } diff --git a/app/layout/aside_feed.phtml b/app/layout/aside_feed.phtml index 67507b88d..e8fdbf842 100644 --- a/app/layout/aside_feed.phtml +++ b/app/layout/aside_feed.phtml @@ -20,6 +20,7 @@
+
  • diff --git a/app/layout/layout.phtml b/app/layout/layout.phtml index 2aeba40a9..189d93fbe 100644 --- a/app/layout/layout.phtml +++ b/app/layout/layout.phtml @@ -42,7 +42,7 @@ ?> allow_referrer) { ?> - + allow_robots) { ?> diff --git a/app/layout/nav_menu.phtml b/app/layout/nav_menu.phtml index 92268ff67..17655acbf 100644 --- a/app/layout/nav_menu.phtml +++ b/app/layout/nav_menu.phtml @@ -88,6 +88,7 @@ type="submit">
    + diff --git a/app/views/auth/formLogin.phtml b/app/views/auth/formLogin.phtml index b0083944f..4bbc8ed55 100644 --- a/app/views/auth/formLogin.phtml +++ b/app/views/auth/formLogin.phtml @@ -6,6 +6,7 @@ +
    diff --git a/app/views/auth/index.phtml b/app/views/auth/index.phtml index 8f81ac856..74e692ec5 100644 --- a/app/views/auth/index.phtml +++ b/app/views/auth/index.phtml @@ -4,6 +4,7 @@ +
    diff --git a/app/views/auth/register.phtml b/app/views/auth/register.phtml index 0c261319a..1f9976391 100644 --- a/app/views/auth/register.phtml +++ b/app/views/auth/register.phtml @@ -1,33 +1,34 @@
    -

    +

    - -
    - - -
    + + +
    + + +
    -
    - -
    - - -
    - -
    +
    + +
    + + +
    + +
    -
    - 'index', 'a' => 'index'), - 'php', true - )); - ?> - - - -
    - +
    + 'index', 'a' => 'index'), + 'php', true + )); + ?> + + + +
    + -

    +

    diff --git a/app/views/configure/archiving.phtml b/app/views/configure/archiving.phtml index 52ee98a48..2254f5dba 100644 --- a/app/views/configure/archiving.phtml +++ b/app/views/configure/archiving.phtml @@ -4,6 +4,7 @@
    +

    @@ -55,6 +56,7 @@
    +
    diff --git a/app/views/configure/display.phtml b/app/views/configure/display.phtml index db6d7951c..62ecc1080 100644 --- a/app/views/configure/display.phtml +++ b/app/views/configure/display.phtml @@ -4,6 +4,7 @@ +
    diff --git a/app/views/configure/queries.phtml b/app/views/configure/queries.phtml index 50df4cfea..0dffa268d 100644 --- a/app/views/configure/queries.phtml +++ b/app/views/configure/queries.phtml @@ -4,6 +4,7 @@ + queries as $key => $query) { ?> diff --git a/app/views/configure/reading.phtml b/app/views/configure/reading.phtml index 9c54b6bd5..07dabf15f 100644 --- a/app/views/configure/reading.phtml +++ b/app/views/configure/reading.phtml @@ -4,6 +4,7 @@ +
    diff --git a/app/views/configure/sharing.phtml b/app/views/configure/sharing.phtml index 7bf435777..0dad5bf6d 100644 --- a/app/views/configure/sharing.phtml +++ b/app/views/configure/sharing.phtml @@ -15,6 +15,7 @@
    '> + sharing as $key => $share_options) { diff --git a/app/views/configure/shortcut.phtml b/app/views/configure/shortcut.phtml index 264a5f805..dceeb17de 100644 --- a/app/views/configure/shortcut.phtml +++ b/app/views/configure/shortcut.phtml @@ -12,6 +12,7 @@ shortcuts; ?> + diff --git a/app/views/configure/system.phtml b/app/views/configure/system.phtml index 4af669eb0..935b49fda 100644 --- a/app/views/configure/system.phtml +++ b/app/views/configure/system.phtml @@ -4,6 +4,7 @@ +
    diff --git a/app/views/extension/index.phtml b/app/views/extension/index.phtml index b26334937..7cb16bfff 100644 --- a/app/views/extension/index.phtml +++ b/app/views/extension/index.phtml @@ -6,6 +6,7 @@

    + extension_list['system'])) { ?>

    + load_ok) { ?>
    diff --git a/app/views/helpers/feed/update.phtml b/app/views/helpers/feed/update.phtml index 72084d8fa..b7e8f68cd 100644 --- a/app/views/helpers/feed/update.phtml +++ b/app/views/helpers/feed/update.phtml @@ -18,6 +18,7 @@ +
    diff --git a/app/views/helpers/javascript_vars.phtml b/app/views/helpers/javascript_vars.phtml index 1aa43a207..745baa195 100644 --- a/app/views/helpers/javascript_vars.phtml +++ b/app/views/helpers/javascript_vars.phtml @@ -16,6 +16,7 @@ echo htmlspecialchars(json_encode(array( 'html5_notif_timeout' => FreshRSS_Context::$user_conf->html5_notif_timeout, 'auth_type' => FreshRSS_Context::$system_conf->auth_type, 'current_view' => Minz_Request::actionName(), + 'csrf' => FreshRSS_Auth::csrfToken(), ), 'shortcuts' => array( 'mark_read' => @$s['mark_read'], diff --git a/app/views/helpers/pagination.phtml b/app/views/helpers/pagination.phtml index d1c3cc72c..23c45114d 100755 --- a/app/views/helpers/pagination.phtml +++ b/app/views/helpers/pagination.phtml @@ -15,6 +15,7 @@ ?> +
    • diff --git a/app/views/importExport/index.phtml b/app/views/importExport/index.phtml index a64524bf1..c0bc412c3 100644 --- a/app/views/importExport/index.phtml +++ b/app/views/importExport/index.phtml @@ -4,6 +4,7 @@ +