From 28439ec79c55cdd90dd31c00c7ae7e742fbb0825 Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Wed, 9 Feb 2022 22:38:13 +0300
Subject: [PATCH] generate csrf token before login (fix for 454ed89)

---
 src/ajax.php  | 6 ++----
 src/index.php | 4 ++++
 src/init.php  | 7 +++++++
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/ajax.php b/src/ajax.php
index 78797ed..7d33d90 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -310,8 +310,7 @@ elseif(isset($_POST['login']))
     if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
         $t['logged'] = 1;
         $_SESSION['logged'] = 1;
-        $_SESSION['token'] = generateUUID();
-        $_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
+        update_token();
     }
     jsonExit($t);
 }
@@ -319,8 +318,7 @@ elseif(isset($_POST['logout']))
 {
     check_token();
     unset($_SESSION['logged']);
-    unset($_SESSION['token']);
-    unset($_SESSION['sign']);
+    update_token();
     session_regenerate_id(1);
     $t = array('logged' => 0);
     jsonExit($t);
diff --git a/src/index.php b/src/index.php
index f82e461..6de0356 100644
--- a/src/index.php
+++ b/src/index.php
@@ -23,6 +23,10 @@ if (!is_int(Config::get('firstdayofweek')) || Config::get('firstdayofweek')<0 ||
     Config::set('firstdayofweek', 1);
 }
 
+if (access_token() == '' && need_auth()) {
+    update_token();
+}
+
 define('TEMPLATEPATH', MTTTHEMES. Config::get('template'). '/');
 
 require(TEMPLATEPATH. 'index.php');
diff --git a/src/init.php b/src/init.php
index 07bf32f..fd4aab7 100644
--- a/src/init.php
+++ b/src/init.php
@@ -150,6 +150,13 @@ function check_token()
     }
 }
 
+function update_token()
+{
+    if (!need_auth()) return;
+    $_SESSION['token'] = generateUUID();
+    $_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
+}
+
 function setup_and_start_session()
 {
     require_once(MTTINC. 'class.sessionhandler.php');