[update] csrf key generation and checking

2 files changed, 52 insertions, 3 deletions

diff --git a/codebase/data_connector.php b/codebase/data_connector.php
index ce454b9..4e6ad76 100644
--- a/codebase/data_connector.php
+++ b/codebase/data_connector.php
@@ -95,9 +95,13 @@ class DataConnector extends Connector{
 	public function __construct($res,$type=false,$item_type=false,$data_type=false,$render_type=false){
 		if (!$item_type) $item_type="CommonDataItem";
 		if (!$data_type) $data_type="CommonDataProcessor";
-		$section = array();
+
+		$this->sections = array();
+		$this->attributes = array();
+
 		if (!$render_type) $render_type="RenderStrategy";
 		parent::__construct($res,$type,$item_type,$data_type,$render_type);
+
 	}
 
 	protected $sections;
@@ -105,6 +109,11 @@ class DataConnector extends Connector{
 		$this->sections[$name] = $string;
 	}
 
+	protected $attributes;
+	public function add_top_attribute($name, $string){
+		$this->attributes[$name] = $string;
+	}
+
 	protected function parse_request_mode(){
 		//do nothing, at least for now
 	}
@@ -138,12 +147,20 @@ class DataConnector extends Connector{
 	
 		if (isset($_GET["start"]) && isset($_GET["count"]))
 			$this->request->set_limit($_GET["start"],$_GET["count"]);
+
+		$key = ConnectorSecurity::checkCSRF($this->editing);
+		if ($key !== "")
+			$this->add_top_attribute("dhx_security", $key);
 	}
 	
 	/*! renders self as  xml, starting part
 	*/
 	protected function xml_start(){
-		$start = "<data>";
+		$start = "<data";
+		foreach($this->attributes as $k=>$v)
+			$start .= " ".$k."='".$v."'";
+		$start.= ">";
+
 		foreach($this->sections as $k=>$v)
 			$start .= "<".$k.">".$v."</".$k.">\n";
 		return $start;
diff --git a/codebase/xss_filter.php b/codebase/xss_filter.php
index 2ac55bb..9018443 100644
--- a/codebase/xss_filter.php
+++ b/codebase/xss_filter.php
@@ -142,7 +142,7 @@ define("DHX_SECURITY_TRUSTED", 3);
 
 class ConnectorSecurity{
     static public $xss = DHX_SECURITY_SAFETEXT;
-    static public $csrf = false;
+    static public $security_key = false;
 
     static private $filterClass = null;
     static function filter($value, $mode = false){
@@ -160,4 +160,36 @@ class ConnectorSecurity{
         }
         throw new Error("Invalid security mode:"+$mode);
     }
+
+    static function CSRF_detected(){
+        LogMaster::log("[SECURITY] Possible CSRF attack detected", array(
+            "referer" => $_SERVER["HTTP_REFERER"],
+            "remote" => $_SERVER["REMOTE_ADDR"]
+        ));
+        LogMaster::log("Request data", $_POST);
+        die();
+    }
+    static function checkCSRF($edit){
+        @session_start();
+
+        if (ConnectorSecurity::$security_key){
+            if ($edit=== true){
+                if (!isset($_POST['dhx_security']))
+                    return ConnectorSecurity::CSRF_detected();
+                $master_key = $_SESSION['dhx_security'];
+                $update_key = $_POST['dhx_security'];
+                if ($master_key != $update_key)
+                    return ConnectorSecurity::CSRF_detected();
+
+                return "";
+            }
+            //data loading
+            if (!array_key_exists("dhx_security",$_SESSION)){
+                $_SESSION["dhx_security"] = md5(uniqid());
+            }
+
+            return $_SESSION["dhx_security"];
+        }
+    }
+
 }
\ No newline at end of file