|
32 | 32 | require_once(APPROOT.'/application/startup.inc.php'); |
33 | 33 | require_once(APPROOT.'/application/user.preferences.class.inc.php'); |
34 | 34 |
|
35 | | -// check if header contains X-Combodo-Ajax for POST request (CSRF protection for ajax calls) |
36 | | -if (!isset($_SERVER['HTTP_X_COMBODO_AJAX']) &&$_SERVER['REQUEST_METHOD'] !=='GET') { |
37 | | -$sReferer =$_SERVER['HTTP_REFERER']; |
38 | | -$sErrorMsg ='Unauthorized access. Please see https://www.itophub.io/wiki/page?id=3_2_0:release:developer#checking_for_the_presence_of_specific_header_in_the_post_to_enhance_protection_against_csrf_attacks'; |
39 | | -IssueLog::Error("Unprotected ajax call :$sErrorMsg", LogChannels::SECURITY, ['referer' =>$sReferer]); |
40 | | -header('HTTP/1.1 401 Unauthorized'); |
41 | | -die($sErrorMsg); |
42 | | -} |
43 | | - |
44 | 35 | IssueLog::Trace('----- Request:'.utils::GetRequestUri(), LogChannels::WEB_REQUEST); |
45 | 36 | $oKPI =newExecutionKPI(); |
46 | 37 | $oKPI->ComputeAndReport('Data model loaded'); |
|
67 | 58 | break; |
68 | 59 | } |
69 | 60 | LoginWebPage::DoLoginEx($sRequestedPortalId,false); |
| 61 | + |
| 62 | +// check if header contains X-Combodo-Ajax for POST request (CSRF protection for ajax calls) |
| 63 | +// check must be performed after DoLoginEx to be logged in and to be able to check the token (based on the transaction id) |
| 64 | +if (!isset($_SERVER['HTTP_X_COMBODO_AJAX']) &&$_SERVER['REQUEST_METHOD'] !=='GET') { |
| 65 | +$sTransactionId = utils::ReadPostedParam("transaction_id"); |
| 66 | +if (!utils::IsTransactionValid($sTransactionId,false)) {// if a form is submitted without header but contains a token... should be exceptional |
| 67 | +$sReferer =$_SERVER['HTTP_REFERER']; |
| 68 | +$sErrorMsg ='Unauthorized access. Please see https://www.itophub.io/wiki/page?id=3_2_0:release:developer#checking_for_the_presence_of_specific_header_in_the_post_to_enhance_protection_against_csrf_attacks'; |
| 69 | +IssueLog::Error("Unprotected ajax call :$sErrorMsg", LogChannels::SECURITY, ['referer' =>$sReferer]); |
| 70 | +header('HTTP/1.1 401 Unauthorized'); |
| 71 | +die($sErrorMsg); |
| 72 | +} |
| 73 | +} |
| 74 | + |
70 | 75 | $oKPI->ComputeAndReport('User login'); |
71 | 76 |
|
72 | 77 | // N°2780 Fix ContextTag for console |
|