From 9f78149fe1f545bc836c62e0512e17eb5a8b18fb Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Mon, 20 Sep 2021 12:06:52 +0300
Subject: [PATCH] * use simple token header for ajax request for safety

---
 src/ajax.php               | 18 ++++++++++++++++++
 src/includes/mytinytodo.js |  5 +++++
 src/index.php              |  1 +
 src/init.php               |  8 ++++++++
 4 files changed, 32 insertions(+)

diff --git a/src/ajax.php b/src/ajax.php
index 8a5d967..383c741 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -21,6 +21,7 @@ $db = DBConnection::instance();
 
 if(isset($_GET['loadLists']))
 {
+	check_token();
 	if (!is_logged()) $sqlWhere = 'WHERE published=1';
 	else $sqlWhere = '';
 	$t = array();
@@ -307,12 +308,15 @@ elseif(isset($_POST['login']))
 		$t['logged'] = 1;
 		session_regenerate_id(1);
 		$_SESSION['logged'] = 1;
+		$_SESSION['token'] = generateUUID();
 	}
 	jsonExit($t);
 }
 elseif(isset($_POST['logout']))
 {
+	check_token();
 	unset($_SESSION['logged']);
+	unset($_SESSION['token']);
 	$t = array('logged' => 0);
 	jsonExit($t);
 }
@@ -579,6 +583,7 @@ function prepareTaskRow($r)
 
 function check_read_access($listId = null)
 {
+	check_token();
 	$db = DBConnection::instance();
 	if(is_logged()) return true;
 	if($listId !== null)
@@ -604,6 +609,7 @@ function have_write_access($listId = null)
 
 function check_write_access($listId = null)
 {
+	check_token();
 	if(have_write_access($listId)) return;
 	jsonExit( array('total'=>0, 'list'=>array(), 'denied'=>1) );
 }
@@ -941,4 +947,16 @@ function getUserListsSimple()
 	return $a;
 }
 
+function check_token()
+{
+	if (!need_auth()) return true;
+	if (!isset($_SESSION)) return true;
+	if (!isset($_SESSION['token'])) return true;
+	$headers = getallheaders();
+	if (!isset($headers['MTT-Token']) || $headers['MTT-Token'] != $_SESSION['token']) {
+		die("Access denied! Try to reload the page.");
+	}
+}
+
+
 ?>
\ No newline at end of file
diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index 53360e7..c7343c6 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -51,6 +51,7 @@ var mytinytodo = window.mytinytodo = _mtt = {
 	mttUrl: '',
 	homeUrl: '',
 	options: {
+		token: '',
 		title: '',
 		openList: 0,
 		autotag: false,
@@ -151,6 +152,10 @@ var mytinytodo = window.mytinytodo = _mtt = {
 
 		jQuery.extend(this.options, options);
 
+		if (this.options.token) {
+			jQuery.ajaxSetup( { headers: { "MTT-Token": this.options.token } } )
+		}
+
 		flag.needAuth = options.needAuth ? true : false;
 		flag.isLogged = options.isLogged ? true : false;
 
diff --git a/src/index.php b/src/index.php
index 3e3ecde..8b20eb2 100644
--- a/src/index.php
+++ b/src/index.php
@@ -51,6 +51,7 @@ function redirectWithHashRoute(array $q, array $hash)
 function js_options()
 {
 	$a = array(
+		"token" => htmlspecialchars(access_token()),
 		"title" => get_unsafe_mttinfo('title'),
 		"lang" => Lang::instance()->jsStrings(),
 		"mttUrl" => get_mttinfo('mtt_url'),
diff --git a/src/init.php b/src/init.php
index 3f19bd3..12f7b8e 100644
--- a/src/init.php
+++ b/src/init.php
@@ -119,6 +119,14 @@ function is_readonly()
 	return false;
 }
 
+function access_token()
+{
+	if (!need_auth()) return '';
+	if (!isset($_SESSION)) return '';
+	if (!isset($_SESSION['token'])) return '';
+	return $_SESSION['token'];
+}
+
 function timestampToDatetime($timestamp)
 {
 	$format = Config::get('dateformat') .' '. (Config::get('clock') == 12 ? 'g:i A' : 'H:i');