From ce01ca5bead2af20bfc1586c17139353bd352463 Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Thu, 10 Feb 2022 00:41:28 +0300
Subject: [PATCH] more fixes for csrf token checking

---
 src/ajax.php               |  6 +++---
 src/includes/mytinytodo.js |  1 +
 src/index.php              |  2 +-
 src/init.php               | 23 +++++++++++++++++------
 4 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/src/ajax.php b/src/ajax.php
index 7d33d90..d5a0e2f 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -308,16 +308,16 @@ elseif(isset($_POST['login']))
         jsonExit($t);
     }
     if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
-        $t['logged'] = 1;
-        $_SESSION['logged'] = 1;
+        updateSessionLogged(true);
         update_token();
+        $t['logged'] = 1;
     }
     jsonExit($t);
 }
 elseif(isset($_POST['logout']))
 {
     check_token();
-    unset($_SESSION['logged']);
+    updateSessionLogged(false);
     update_token();
     session_regenerate_id(1);
     $t = array('logged' => 0);
diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index 0e432cc..c6e271e 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -546,6 +546,7 @@ var mytinytodo = window.mytinytodo = _mtt = {
 		$(document).ajaxError(function(event, request, settings){
 			var errtxt;
 			if(request.status == 0) errtxt = 'Bad connection';
+			else if(request.status == 403) errtxt = request.responseText;
 			else if(request.status != 200) errtxt = 'HTTP: '+request.status+'/'+request.statusText;
 			else errtxt = request.responseText;
 			flashError(_mtt.lang.get('error'), errtxt);
diff --git a/src/index.php b/src/index.php
index 6de0356..ffa18b6 100644
--- a/src/index.php
+++ b/src/index.php
@@ -23,7 +23,7 @@ if (!is_int(Config::get('firstdayofweek')) || Config::get('firstdayofweek')<0 ||
     Config::set('firstdayofweek', 1);
 }
 
-if (access_token() == '' && need_auth()) {
+if (need_auth() && access_token() == '') {
     update_token();
 }
 
diff --git a/src/init.php b/src/init.php
index fd4aab7..b449f51 100644
--- a/src/init.php
+++ b/src/init.php
@@ -132,6 +132,18 @@ function is_readonly(): bool
     return false;
 }
 
+function updateSessionLogged(bool $logged)
+{
+    if ($logged) {
+        $_SESSION['logged'] = 1;
+        $_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
+    }
+    else {
+        unset($_SESSION['logged']);
+        unset($_SESSION['sign']);
+    }
+}
+
 function access_token(): string
 {
     if (!need_auth()) return '';
@@ -142,19 +154,18 @@ function access_token(): string
 
 function check_token()
 {
+    if (!need_auth()) return;
     $token = access_token();
-    if ($token == '') return true;
-    if (!isset($_SERVER)) return true;
-    if (!isset($_SERVER['HTTP_MTT_TOKEN']) || $_SERVER['HTTP_MTT_TOKEN'] != $token) {
+    if ($token == '' || !isset($_SERVER['HTTP_MTT_TOKEN']) || $_SERVER['HTTP_MTT_TOKEN'] != $token) {
+        http_response_code(403);
         die("Access denied! Try to reload the page.");
     }
 }
 
-function update_token()
+function update_token(): string
 {
-    if (!need_auth()) return;
     $_SESSION['token'] = generateUUID();
-    $_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
+    return $_SESSION['token'];
 }
 
 function setup_and_start_session()