prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

* use simple token header for ajax request for safety

Browse source
This commit is contained in:
Max Pozdeev 2021-09-20 12:06:52 +03:00
parent 9c891da92c
commit 9f78149fe1
4 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/ajax.php
View file

@ -21,6 +21,7 @@ $db = DBConnection::instance();
if(isset($_GET['loadLists']))
{
check_token();
if (!is_logged()) $sqlWhere = 'WHERE published=1';
else $sqlWhere = '';
$t = array();
@ -307,12 +308,15 @@ elseif(isset($_POST['login']))
$t['logged'] = 1;
session_regenerate_id(1);
$_SESSION['logged'] = 1;
$_SESSION['token'] = generateUUID();
}
jsonExit($t);
}
elseif(isset($_POST['logout']))
{
check_token();
unset($_SESSION['logged']);
unset($_SESSION['token']);
$t = array('logged' => 0);
jsonExit($t);
}
@ -579,6 +583,7 @@ function prepareTaskRow($r)
function check_read_access($listId = null)
{
check_token();
$db = DBConnection::instance();
if(is_logged()) return true;
if($listId !== null)
@ -604,6 +609,7 @@ function have_write_access($listId = null)
function check_write_access($listId = null)
{
check_token();
if(have_write_access($listId)) return;
jsonExit( array('total'=>0, 'list'=>array(), 'denied'=>1) );
}
@ -941,4 +947,16 @@ function getUserListsSimple()
return $a;
}
function check_token()
{
if (!need_auth()) return true;
if (!isset($_SESSION)) return true;
if (!isset($_SESSION['token'])) return true;
$headers = getallheaders();
if (!isset($headers['MTT-Token']) || $headers['MTT-Token'] != $_SESSION['token']) {
die("Access denied! Try to reload the page.");
}
}
?>

5
src/includes/mytinytodo.js
View file

@ -51,6 +51,7 @@ var mytinytodo = window.mytinytodo = _mtt = {
mttUrl: '',
homeUrl: '',
options: {
token: '',
title: '',
openList: 0,
autotag: false,
@ -151,6 +152,10 @@ var mytinytodo = window.mytinytodo = _mtt = {
jQuery.extend(this.options, options);
if (this.options.token) {
jQuery.ajaxSetup( { headers: { "MTT-Token": this.options.token } } )
}
flag.needAuth = options.needAuth ? true : false;
flag.isLogged = options.isLogged ? true : false;

1
src/index.php
View file

@ -51,6 +51,7 @@ function redirectWithHashRoute(array $q, array $hash)
function js_options()
{
$a = array(
"token" => htmlspecialchars(access_token()),
"title" => get_unsafe_mttinfo('title'),
"lang" => Lang::instance()->jsStrings(),
"mttUrl" => get_mttinfo('mtt_url'),

8
src/init.php
View file

@ -119,6 +119,14 @@ function is_readonly()
return false;
}
function access_token()
{
if (!need_auth()) return '';
if (!isset($_SESSION)) return '';
if (!isset($_SESSION['token'])) return '';
return $_SESSION['token'];
}
function timestampToDatetime($timestamp)
{
$format = Config::get('dateformat') .' '. (Config::get('clock') == 12 ? 'g:i A' : 'H:i');