kazhnuz/koblog
1
0
Fork 0
Code Issues 31 Pull requests Projects 3 Releases Packages Wiki Activity Actions

Merge pull request #2 from alromh87/master

Browse source 
Fix Cross Site Request Forgery on theme selection by using token
This commit is contained in:
Jamie Slome 2020-08-25 13:58:16 +01:00 • committed by GitHub
commit b038016daf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
bl-kernel/admin/controllers/install-theme.php
View file

@ -21,10 +21,25 @@ checkRole(array('admin'));
// ============================================================================ // ============================================================================
// Main after POST // Main after POST
// ============================================================================ // ============================================================================
$themeDirectory = $layout['parameters']; $token = "";
$parameters = explode("/", $layout['parameters']);
if(count($parameters)==2) {
$themeDirectory = $parameters[0];
// Activate theme // Verify CSRF Token
activateTheme($themeDirectory); $token = Sanitize::html($parameters[1]);
if ($security->validateTokenCSRF($token)) {
// Activate theme
activateTheme($themeDirectory);
// Redirect
Redirect::page('themes');
}
}
Log::set(__FILE__.LOG_SEP.'Error occurred when trying to validate the tokenCSRF.', ALERT_STATUS_FAIL);
Log::set(__FILE__.LOG_SEP.'Token in install theme ['.$token.']', ALERT_STATUS_FAIL);
Session::destroy();
Redirect::page('login');
// Redirect
Redirect::page('themes');

2
bl-kernel/admin/views/themes.php
View file

@ -24,7 +24,7 @@ foreach ($themes as $theme) {
'; ';
if ($theme['dirname']!=$site->theme()) { if ($theme['dirname']!=$site->theme()) {
echo '<a href="'.HTML_PATH_ADMIN_ROOT.'install-theme/'.$theme['dirname'].'">'.$L->g('Activate').'</a>'; echo '<a href="'.HTML_PATH_ADMIN_ROOT.'install-theme/'.$theme['dirname'].'/'.$security->getTokenCSRF().'">'.$L->g('Activate').'</a>';
} }
echo ' echo '