From 24223bf7a32315318768528e1f236353c77c4336 Mon Sep 17 00:00:00 2001
From: maxpozdeev <maxpozdeev@gmail.com>
Date: Fri, 28 Oct 2022 21:29:21 +0300
Subject: [PATCH] * use anti-csrf token header for ajax requests on
 passwordless installations

---
 src/index.php |  2 +-
 src/init.php  | 29 +++++++++++++++++++++--------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/src/index.php b/src/index.php
index 49b1206..72b0a7e 100644
--- a/src/index.php
+++ b/src/index.php
@@ -24,7 +24,7 @@ if (!is_int(Config::get('firstdayofweek')) || Config::get('firstdayofweek')<0 ||
     Config::set('firstdayofweek', 1);
 }
 
-if (need_auth() && access_token() == '') {
+if ( access_token() == '' ) {
     update_token();
 }
 
diff --git a/src/init.php b/src/init.php
index 6a46bc1..2000663 100644
--- a/src/init.php
+++ b/src/init.php
@@ -165,26 +165,36 @@ function updateSessionLogged(bool $logged)
 
 function access_token(): string
 {
-    if (!need_auth()) return '';
-    if (!isset($_SESSION)) return '';
-    if (!isset($_SESSION['token'])) return '';
-    return $_SESSION['token'];
+    if ( need_auth() ) {
+        if (!isset($_SESSION)) return '';
+        return $_SESSION['token'] ?? '';
+    }
+    else {
+        if (!isset($_COOKIE)) return '';
+        return $_COOKIE['mtt-token'] ?? '';
+    }
 }
 
 function check_token()
 {
-    if (!need_auth()) return;
     $token = access_token();
     if ($token == '' || !isset($_SERVER['HTTP_MTT_TOKEN']) || $_SERVER['HTTP_MTT_TOKEN'] != $token) {
         http_response_code(403);
-        die("Access denied! You must authenticate first.");
+        die("Access denied! No token provided.");
     }
 }
 
 function update_token(): string
 {
-    $_SESSION['token'] = generateUUID();
-    return $_SESSION['token'];
+    $token = generateUUID();
+    if ( need_auth() ) {
+        $_SESSION['token'] = $token;
+    }
+    else {
+        setcookie('mtt-token', $token, 0, url_dir(get_unsafe_mttinfo('mtt_url')) );
+        $_COOKIE['mtt-token'] = $token;
+    }
+    return $token;
 }
 
 function setup_and_start_session()
@@ -353,6 +363,9 @@ function is_https(): bool
     if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') {
         return true;
     }
+    /*
+     TODO: Check for X-Forwarded-Proto==https or X-Forwarded-For==https ?
+     */
     if (defined('MTT_USE_HTTPS') && MTT_USE_HTTPS) {
         return true;
     }