mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-02 04:24:56 +02:00
Code Issues Releases Wiki Activity

[ticket/security/244] Add form token check to plupload

Browse Source 
SECURTIY-244
This commit is contained in:
Marc Alexander 2019-06-30 22:40:34 +02:00
parent 525c940385
commit 56477a8f7c
No known key found for this signature in database
GPG Key ID: 50E0D2423696F995
4 changed files with 52 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
phpBB/assets/javascript/plupload.js
View File

@ -90,6 +90,12 @@ phpbb.plupload.getSerializedData = function() {
obj['attachment_data[' + i + '][' + key + ']'] = datum[key];
}
}
// Insert form data
var $pluploadForm = $(phpbb.plupload.config.form_hook).first();
obj.creation_time = $pluploadForm.find('input[type=hidden][name="creation_time"]').val();
obj.form_token = $pluploadForm.find('input[type=hidden][name="form_token"]').val();
return obj;
};
@ -264,6 +270,17 @@ phpbb.plupload.deleteFile = function(row, attachId) {
return;
}
// Handle errors while deleting file
if (typeof response.error !== 'undefined') {
phpbb.alert(phpbb.plupload.lang.ERROR, response.error.message);
// We will have to assume that the deletion failed. So leave the file status as uploaded.
row.find('.file-status').toggleClass('file-uploaded');
return;
}
phpbb.plupload.update(response, 'removal', index);
// Check if the user can upload files now if he had reached the max files limit.
phpbb.plupload.handleMaxFilesReached();

29
phpBB/includes/message_parser.php
View File

@ -1524,6 +1524,35 @@ class parse_message extends bbcode_firstpass
}
}
/**
* Check attachment form token depending on submit type
*
* @param \phpbb\language\language $language Language
* @param \phpbb\request\request_interface $request Request
* @param string $form_name Form name for checking form key
*
* @return bool True if form token is not needed or valid, false if needed and invalid
*/
function check_attachment_form_token(\phpbb\language\language $language, \phpbb\request\request_interface $request, $form_name)
{
$add_file = $request->is_set_post('add_file');
$delete_file = $request->is_set_post('delete_file');
if (($add_file || $delete_file) && !check_form_key($form_name))
{
$this->warn_msg[] = $language->lang('FORM_INVALID');
if ($request->is_ajax() && $this->plupload)
{
$this->plupload->emit_error(-400, 'FORM_INVALID');
}
return false;
}
return true;
}
/**
* Parse Attachments
*/

7
phpBB/includes/ucp/ucp_pm_compose.php
View File

@ -26,7 +26,7 @@ if (!defined('IN_PHPBB'))
function compose_pm($id, $mode, $action, $user_folders = array())
{
global $template, $db, $auth, $user, $cache;
global $phpbb_root_path, $phpEx, $config;
global $phpbb_root_path, $phpEx, $config, $language;
global $request, $phpbb_dispatcher, $phpbb_container;
// Damn php and globals - i know, this is horrible
@ -799,7 +799,10 @@ function compose_pm($id, $mode, $action, $user_folders = array())
extract($phpbb_dispatcher->trigger_event('core.ucp_pm_compose_modify_parse_before', compact($vars)));
// Parse Attachments - before checksum is calculated
$message_parser->parse_attachments('fileupload', $action, 0, $submit, $preview, $refresh, true);
if ($message_parser->check_attachment_form_token($language, $request, 'ucp_pm_compose'))
{
$message_parser->parse_attachments('fileupload', $action, 0, $submit, $preview, $refresh, true);
}
if (count($message_parser->warn_msg) && !($remove_u || $remove_g || $add_to || $add_bcc))
{

1
phpBB/styles/prosilver/template/plupload.html
View File

@ -57,6 +57,7 @@ phpbb.plupload = {
lang: {
ERROR: '{LA_ERROR}',
TOO_MANY_ATTACHMENTS: '{LA_TOO_MANY_ATTACHMENTS}',
FORM_INVALID: '{LA_FORM_INVALID}',
},
order: '{ATTACH_ORDER}',
maxFiles: {MAX_ATTACHMENTS},