Security Hardening: Move to new CSRF Token system.

Author: jhuckaby

htdocs/js/pages/Events.class.js

@@ -2362,7 +2362,7 @@ Page.Events = class Events extends Page.PageUtils {
 
 		Dialog.onDragDrop = function(files) {
 			// files dropped on dialog
-			ZeroUpload.upload( files, {}, {} );
+			ZeroUpload.upload( files, {}, app.csrf_token ? { csrf_token: app.csrf_token } : {} );
 		};
 
 		Dialog.onHide = function() {

htdocs/js/pages/PageUtils.class.js

@@ -5410,7 +5410,7 @@ Page.PageUtils = class PageUtils extends Page.Base {
 
 		Dialog.onDragDrop = function(files) {
 			// files dropped on dialog
-			ZeroUpload.upload( files, {}, {} );
+			ZeroUpload.upload( files, {}, app.csrf_token ? { csrf_token: app.csrf_token } : {} );
 		};
 
 		Dialog.onHide = function() {
@@ -5499,7 +5499,7 @@ Page.PageUtils = class PageUtils extends Page.Base {
 
 	uploadDialogFiles() {
 		// upload files using ZeroUpload (for progress, etc.)
-		ZeroUpload.chooseFiles({}, {});
+		ZeroUpload.chooseFiles( {}, app.csrf_token ? { csrf_token: app.csrf_token } : {} );
 	}
 
 	addPageDescription(page_id) {

htdocs/js/pages/Tickets.class.js

@@ -1314,6 +1314,7 @@ Page.Tickets = class Tickets extends Page.PageUtils {
 		if (this.editor) return app.doError("Please close the current text editor before attaching files.");
 
 		ZeroUpload.chooseFiles({}, {
+			csrf_token: app.csrf_token || '',
 			ticket: this.ticket.id,
 			save: true
 		});
@@ -2467,6 +2468,7 @@ Page.Tickets = class Tickets extends Page.PageUtils {
 		// intercept drag-drop event and upload files to ticket
 		if (this.args.sub == 'view') {
 			ZeroUpload.upload( files, {}, {
+				csrf_token: app.csrf_token || '',
 				ticket: this.ticket.id || 'new',
 				save: this.editor ? false : true
 			} );
@@ -2478,6 +2480,7 @@ Page.Tickets = class Tickets extends Page.PageUtils {
 		if (!this.editor) return; // sanity
 
 		ZeroUpload.chooseFiles({}, {
+			csrf_token: app.csrf_token || '',
 			ticket: this.ticket.id || 'new'
 		});
 	}

htdocs/js/pages/Workflows.class.js

@@ -1421,7 +1421,7 @@ Page.Workflows = class Workflows extends Page.Events {
 
 		Dialog.onDragDrop = function(files) {
 			// files dropped on dialog
-			ZeroUpload.upload( files, {}, {} );
+			ZeroUpload.upload( files, {}, app.csrf_token ? { csrf_token: app.csrf_token } : {} );
 		};
 
 		Dialog.onHide = function() {

htdocs/js/pages/admin/Buckets.class.js

@@ -540,6 +540,7 @@ Page.Buckets = class Buckets extends Page.PageUtils {
 		if (!this.bucket.id) return; // sanity
 
 		ZeroUpload.chooseFiles({}, {
+			csrf_token: app.csrf_token || '',
 			bucket: this.bucket.id
 		});
 	}
@@ -548,6 +549,7 @@ Page.Buckets = class Buckets extends Page.PageUtils {
 		// intercept drag-drop event and upload files to bucket
 		if (this.args.sub == 'edit') {
 			ZeroUpload.upload( files, {}, {
+				csrf_token: app.csrf_token || '',
 				bucket: this.bucket.id
 			} );
 		}

htdocs/js/pages/admin/Plugins.class.js

@@ -527,7 +527,7 @@ Page.Plugins = class Plugins extends Page.PageUtils {
 
 		Dialog.onDragDrop = function(files) {
 			// files dropped on dialog
-			ZeroUpload.upload( files, {}, {} );
+			ZeroUpload.upload( files, {}, app.csrf_token ? { csrf_token: app.csrf_token } : {} );
 		};
 
 		Dialog.onHide = function() {

htdocs/js/pages/admin/Users.class.js

@@ -332,6 +332,7 @@ Page.Users = class Users extends Page.PageUtils {
 	upload_avatar() {
 		// upload profile pic using ZeroUpload
 		ZeroUpload.chooseFiles({}, {
+			csrf_token: app.csrf_token || '',
 			username: this.user.username
 		});
 	}

htdocs/js/pages/user/MyAccount.class.js

@@ -197,7 +197,7 @@ Page.MyAccount = class MyAccount extends Page.Base {
 
 	uploadAvatar() {
 		// upload profile pic using ZeroUpload
-		ZeroUpload.chooseFiles({}, {});
+		ZeroUpload.chooseFiles( {}, app.csrf_token ? { csrf_token: app.csrf_token } : {} );
 	}
 
 	uploadStart(files, userData) {

lib/api.js

@@ -541,6 +541,13 @@ class API {
 			this.storage.get('sessions/' + session_id, function(err, session) {
 				if (err) return callback(err, null, null);
 
+				// csrf check
+				var csrf_token = args.request.headers['x-csrf-token'] || args.params.csrf_token || null;
+				if (self.usermgr.config.get('use_csrf') && !args.request.method.match(/^(GET|HEAD)$/) && session.csrf_token && (csrf_token != session.csrf_token)) {
+					self.logError('user', "Failed to validate session: Invalid CSRF Token", { username: session.username, ips: args.ips });
+					return callback(new Error("Invalid session"), null, null);
+				}
+				
 				// also load user
 				self.storage.get('users/' + self.usermgr.normalizeUsername(session.username), function(err, user) {
 					if (err) return callback(err, null, null);
@@ -554,6 +561,10 @@ class API {
 					delete args.request.headers['x-session-id'];
 					delete args.request.headers['cookie'];
 
+					// cleanup csrf token mess as well
+					delete args.params.csrf_token;
+					delete args.request.headers['x-csrf-token'];
+					
 					// pass both session and user to callback
 					callback(null, session, user);
 				} );

lib/comm.js

@@ -241,7 +241,7 @@ class Communication {
 				}
 
 				// create fake args object for loadSession
-				var args = { cookies: {}, request: { headers: {} }, params: {} };
+				var args = { cookies: {}, request: { method: 'GET', headers: {} }, params: {} };
 
 				// pull session_id out of original ws request cookies
 				if (socket.request.headers.cookie && socket.request.headers.cookie.match(/\bsession_id\=([0-9a-f]{64})\b/)) {