prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

* use simple token header for ajax request for safety

Browse source
This commit is contained in:
Max Pozdeev 2021-09-20 12:06:52 +03:00
parent 7f2ac0c0c2
commit c22798cf19
4 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/ajax.php
View file

@ -15,6 +15,7 @@ $db = DBConnection::instance();
if(isset($_GET['loadLists']))
{
check_token();
if (!is_logged()) $sqlWhere = 'WHERE published=1';
else $sqlWhere = '';
$t = array();
@ -300,12 +301,15 @@ elseif(isset($_POST['login']))
$t['logged'] = 1;
session_regenerate_id(1);
$_SESSION['logged'] = 1;
$_SESSION['token'] = generateUUID();
}
jsonExit($t);
}
elseif(isset($_POST['logout']))
{
check_token();
unset($_SESSION['logged']);
unset($_SESSION['token']);
$t = array('logged' => 0);
jsonExit($t);
}
@ -557,6 +561,7 @@ function prepareTaskRow($r)
function check_read_access($listId = null)
{
check_token();
$db = DBConnection::instance();
if(is_logged()) return true;
if($listId !== null)
@ -582,6 +587,7 @@ function have_write_access($listId = null)
function check_write_access($listId = null)
{
check_token();
if(have_write_access($listId)) return;
jsonExit( array('total'=>0, 'list'=>array(), 'denied'=>1) );
}
@ -873,4 +879,16 @@ function getUserListsSimple()
return $a;
}
function check_token()
{
if (!need_auth()) return true;
if (!isset($_SESSION)) return true;
if (!isset($_SESSION['token'])) return true;
$headers = getallheaders();
if (!isset($headers['MTT-Token']) || $headers['MTT-Token'] != $_SESSION['token']) {
die("Access denied! Try to reload the page.");
}
}
?>

1
src/content/themes/default/index.php
View file

@ -28,6 +28,7 @@
<script type="text/javascript">
$().ready(function(){
mytinytodo.init({
token: "<?php echo htmlspecialchars(access_token()); ?>" ,
title: <?php echo json_encode(get_unsafe_mttinfo('title'), JSON_UNESCAPED_UNICODE); ?> ,
lang: <?php echo Lang::instance()->makeJS() ?>,
mttUrl: "<?php mttinfo('mtt_url'); ?>",

5
src/includes/mytinytodo.js
View file

@ -51,6 +51,7 @@ var mytinytodo = window.mytinytodo = _mtt = {
mttUrl: '',
homeUrl: '',
options: {
token: '',
title: '',
openList: 0,
singletab: false,
@ -133,6 +134,10 @@ var mytinytodo = window.mytinytodo = _mtt = {
jQuery.extend(this.options, options);
if (this.options.token) {
jQuery.ajaxSetup( { headers: { "MTT-Token": this.options.token } } )
}
flag.needAuth = options.needAuth ? true : false;
flag.isLogged = options.isLogged ? true : false;

8
src/init.php
View file

@ -106,6 +106,14 @@ function is_readonly()
return false;
}
function access_token()
{
if (!need_auth()) return '';
if (!isset($_SESSION)) return '';
if (!isset($_SESSION['token'])) return '';
return $_SESSION['token'];
}
function timestampToDatetime($timestamp)
{
$format = Config::get('dateformat') .' '. (Config::get('clock') == 12 ? 'g:i A' : 'H:i');