From c22798cf19c90bce1b0c0f02f1ef48ed7721bba4 Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Mon, 20 Sep 2021 12:06:52 +0300
Subject: [PATCH] * use simple token header for ajax request for safety

---
 src/ajax.php                         | 18 ++++++++++++++++++
 src/content/themes/default/index.php |  1 +
 src/includes/mytinytodo.js           |  5 +++++
 src/init.php                         |  8 ++++++++
 4 files changed, 32 insertions(+)

diff --git a/src/ajax.php b/src/ajax.php
index 665996e..5ea3196 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -15,6 +15,7 @@ $db = DBConnection::instance();
 
 if(isset($_GET['loadLists']))
 {
+	check_token();
 	if (!is_logged()) $sqlWhere = 'WHERE published=1';
 	else $sqlWhere = '';
 	$t = array();
@@ -300,12 +301,15 @@ elseif(isset($_POST['login']))
 		$t['logged'] = 1;
 		session_regenerate_id(1);
 		$_SESSION['logged'] = 1;
+		$_SESSION['token'] = generateUUID();
 	}
 	jsonExit($t);
 }
 elseif(isset($_POST['logout']))
 {
+	check_token();
 	unset($_SESSION['logged']);
+	unset($_SESSION['token']);
 	$t = array('logged' => 0);
 	jsonExit($t);
 }
@@ -557,6 +561,7 @@ function prepareTaskRow($r)
 
 function check_read_access($listId = null)
 {
+	check_token();
 	$db = DBConnection::instance();
 	if(is_logged()) return true;
 	if($listId !== null)
@@ -582,6 +587,7 @@ function have_write_access($listId = null)
 
 function check_write_access($listId = null)
 {
+	check_token();
 	if(have_write_access($listId)) return;
 	jsonExit( array('total'=>0, 'list'=>array(), 'denied'=>1) );
 }
@@ -873,4 +879,16 @@ function getUserListsSimple()
 	return $a;
 }
 
+function check_token()
+{
+	if (!need_auth()) return true;
+	if (!isset($_SESSION)) return true;
+	if (!isset($_SESSION['token'])) return true;
+	$headers = getallheaders();
+	if (!isset($headers['MTT-Token']) || $headers['MTT-Token'] != $_SESSION['token']) {
+		die("Access denied! Try to reload the page.");
+	}
+}
+
+
 ?>
\ No newline at end of file
diff --git a/src/content/themes/default/index.php b/src/content/themes/default/index.php
index 4b597ea..e4c3e1a 100644
--- a/src/content/themes/default/index.php
+++ b/src/content/themes/default/index.php
@@ -28,6 +28,7 @@
 <script type="text/javascript">
 $().ready(function(){
 	mytinytodo.init({
+		token: "<?php echo htmlspecialchars(access_token()); ?>" ,
 		title: <?php echo json_encode(get_unsafe_mttinfo('title'), JSON_UNESCAPED_UNICODE); ?> ,
 		lang: <?php echo Lang::instance()->makeJS() ?>,
 		mttUrl: "<?php mttinfo('mtt_url'); ?>",
diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index 4343bfc..88fdd61 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -51,6 +51,7 @@ var mytinytodo = window.mytinytodo = _mtt = {
 	mttUrl: '',
 	homeUrl: '',
 	options: {
+		token: '',
 		title: '',
 		openList: 0,
 		singletab: false,
@@ -133,6 +134,10 @@ var mytinytodo = window.mytinytodo = _mtt = {
 
 		jQuery.extend(this.options, options);
 
+		if (this.options.token) {
+			jQuery.ajaxSetup( { headers: { "MTT-Token": this.options.token } } )
+		}
+
 		flag.needAuth = options.needAuth ? true : false;
 		flag.isLogged = options.isLogged ? true : false;
 
diff --git a/src/init.php b/src/init.php
index 5e8256f..d652c77 100644
--- a/src/init.php
+++ b/src/init.php
@@ -106,6 +106,14 @@ function is_readonly()
 	return false;
 }
 
+function access_token()
+{
+	if (!need_auth()) return '';
+	if (!isset($_SESSION)) return '';
+	if (!isset($_SESSION['token'])) return '';
+	return $_SESSION['token'];
+}
+
 function timestampToDatetime($timestamp)
 {
 	$format = Config::get('dateformat') .' '. (Config::get('clock') == 12 ? 'g:i A' : 'H:i');