public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2026-02-03 11:47:12 +00:00
Code Issues Releases Wiki Activity

experimental CSRF protection

Browse Source
This commit is contained in:
Andrew Dolgov
2011-12-26 12:02:52 +04:00
parent 036cd3a410
commit 8484ce2258
14 changed files with 106 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
classes/article.php
View File

@@ -1,6 +1,12 @@
<?php
class Article extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("redirect");
return array_search($method, $csrf_ignored) !== false;
}
function redirect() {
$id = db_escape_string($_REQUEST['id']);

6
classes/feeds.php
View File

@@ -1,6 +1,12 @@
<?php
class Feeds extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("index");
return array_search($method, $csrf_ignored) !== false;
}
private function feedlist_init_cat($cat_id, $hidden = false) {
$obj = array();
$cat_id = (int) $cat_id;

4
classes/handler.php
View File

@@ -8,6 +8,10 @@ class Handler {
$this->args = $args;
}
function csrf_ignore($method) {
return true;
}
function before() {
return true;
}

7
classes/pref_feeds.php
View File

@@ -1,5 +1,12 @@
<?php
class Pref_Feeds extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("index", "getfeedtree", "add", "editcats", "editfeed");
return array_search($method, $csrf_ignored) !== false;
}
function batch_edit_cbox($elem, $label = false) {
print "<input type=\"checkbox\" title=\"".__("Check to enable field")."\"
onchange=\"dijit.byId('feedEditDlg').toggleField(this, '$elem', '$label')\">";

6
classes/pref_filters.php
View File

@@ -1,6 +1,12 @@
<?php
class Pref_Filters extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("index", "getfiltertree", "edit");
return array_search($method, $csrf_ignored) !== false;
}
function filter_test($filter_type, $reg_exp,
$action_id, $action_param, $filter_param, $inverse, $feed_id) {

6
classes/pref_instances.php
View File

@@ -1,6 +1,12 @@
<?php
class Pref_Instances extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("index", "edit");
return array_search($method, $csrf_ignored) !== false;
}
function before() {
if (parent::before()) {
if ($_SESSION["access_level"] < 10) {

6
classes/pref_labels.php
View File

@@ -1,6 +1,12 @@
<?php
class Pref_Labels extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("index", "getlabeltree", "edit");
return array_search($method, $csrf_ignored) !== false;
}
function edit() {
$label_id = db_escape_string($_REQUEST['id']);

6
classes/pref_prefs.php
View File

@@ -1,6 +1,12 @@
<?php
class Pref_Prefs extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("index");
return array_search($method, $csrf_ignored) !== false;
}
function changepassword() {
$old_pw = $_POST["old_password"];

7
classes/pref_users.php
View File

@@ -1,6 +1,5 @@
<?php
class Pref_Users extends Protected_Handler {
function before() {
if (parent::before()) {
if ($_SESSION["access_level"] < 10) {
@@ -12,6 +11,12 @@ class Pref_Users extends Protected_Handler {
return false;
}
function csrf_ignore($method) {
$csrf_ignored = array("index");
return array_search($method, $csrf_ignored) !== false;
}
function userdetails() {
header("Content-Type: text/xml");

6
classes/rpc.php
View File

@@ -1,6 +1,12 @@
<?php
class RPC extends Protected_Handler {
function csrf_ignore($method) {
$csrf_ignored = array("sanitycheck", "buttonplugin");
return array_search($method, $csrf_ignored) !== false;
}
function setprofile() {
$id = db_escape_string($_REQUEST["id"]);