Merge pull request #129 from CatoTH/master

CSRF-Protection and minor changes

include/conversation.php

@@ -375,7 +375,8 @@ function conversation(&$a, $items, $mode, $update, $preview = false) {
 						$comments[$item['parent']] = 1;
 					else
 						$comments[$item['parent']] += 1;
-				}
+				} elseif(! x($comments,$item['parent'])) 
+					$comments[$item['parent']] = 0; // avoid notices later on
 			}
 
 			// map all the like/dislike activities for each parent item 
@@ -915,7 +916,7 @@ function status_editor($a,$x, $notes_cid = 0, $popup=false) {
 	$o .= replace_macros($tpl,array(
 		'$return_path' => $a->cmd,
 		'$action' =>  $a->get_baseurl().'/item',
-		'$share' => (($x['button']) ? $x['button'] : t('Share')),
+		'$share' => (x($x,'button') ? $x['button'] : t('Share')),
 		'$upload' => t('Upload photo'),
 		'$shortupload' => t('upload photo'),
 		'$attach' => t('Attach file'),
@@ -980,8 +981,8 @@ function conv_sort($arr,$order) {
 		usort($parents,'sort_thr_commented');
 
 	if(count($parents))
-		foreach($parents as $x) 
-			$x['children'] = array();
+		foreach($parents as $i=>$_x) 
+			$parents[$i]['children'] = array();
 
 	foreach($arr as $x) {
 		if($x['id'] != $x['parent']) {

include/event.php

@@ -163,7 +163,7 @@ function bbtoevent($s) {
 	if(preg_match("/\[event\-adjust\](.*?)\[\/event\-adjust\]/is",$s,$match))
 		$ev['adjust'] = $match[1];
 	$match = '';
-	$ev['nofinish'] = (($ev['start'] && (!x($ev, 'finish') || !$ev['finish'])) ? 1 : 0);
+	$ev['nofinish'] = (((x($ev, 'start') && $ev['start']) && (!x($ev, 'finish') || !$ev['finish'])) ? 1 : 0);
 	return $ev;
 
 }

include/items.php

@@ -682,7 +682,7 @@ function item_store($arr,$force_parent = false) {
 		unset($arr['dsprsig']);
 	}
 
-	if($arr['gravity'])
+	if(x($arr, 'gravity'))
 		$arr['gravity'] = intval($arr['gravity']);
 	elseif($arr['parent-uri'] === $arr['uri'])
 		$arr['gravity'] = 0;
@@ -742,6 +742,7 @@ function item_store($arr,$force_parent = false) {
 
 	if($arr['parent-uri'] === $arr['uri']) {
 		$parent_id = 0;
+		$parent_deleted = 0;
 		$allow_cid = $arr['allow_cid'];
 		$allow_gid = $arr['allow_gid'];
 		$deny_cid  = $arr['deny_cid'];
@@ -800,6 +801,8 @@ function item_store($arr,$force_parent = false) {
 				logger('item_store: item parent was not found - ignoring item');
 				return 0;
 			}
+			
+			$parent_deleted = 0;
 		}
 	}
 

include/oembed.php

@@ -62,7 +62,7 @@ function oembed_fetch_url($embedurl){
 	
 function oembed_format_object($j){
 	$embedurl = $j->embedurl;
-	$jhtml = oembed_iframe($j->embedurl,$j->width,$j->height );
+	$jhtml = oembed_iframe($j->embedurl,(isset($j->width) ? $j->width : null), (isset($j->height) ? $j->height : null) );
 	$ret="<span class='oembed ".$j->type."'>";
 	switch ($j->type) {
 		case "video": {

include/security.php

@@ -288,3 +288,49 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null)
 }
 
 
+/*
+ * Functions used to protect against Cross-Site Request Forgery
+ * The security token has to base on at least one value that an attacker can't know - here it's the session ID and the private key.
+ * In this implementation, a security token is reusable (if the user submits a form, goes back and resubmits the form, maybe with small changes;
+ * or if the security token is used for ajax-calls that happen several times), but only valid for a certain amout of time (3hours).
+ * The "typename" seperates the security tokens of different types of forms. This could be relevant in the following case:
+ *    A security token is used to protekt a link from CSRF (e.g. the "delete this profile"-link).
+ *    If the new page contains by any chance external elements, then the used security token is exposed by the referrer.
+ *    Actually, important actions should not be triggered by Links / GET-Requests at all, but somethimes they still are,
+ *    so this mechanism brings in some damage control (the attacker would be able to forge a request to a form of this type, but not to forms of other types).
+ */ 
+function get_form_security_token($typename = "") {
+	$a = get_app();
+	
+	$timestamp = time();
+	$sec_hash = hash('whirlpool', $a->user["guid"] . $a->user["prvkey"] . session_id() . $timestamp . $typename);
+	
+	return $timestamp . "." . $sec_hash;
+}
+
+function check_form_security_token($typename = "", $formname = 'form_security_token') {
+	if (!x($_REQUEST, $formname)) return false;
+	$hash = $_REQUEST[$formname];
+	
+	$max_livetime = 10800; // 3 hours
+	
+	$a = get_app();
+	
+	$x = explode(".", $hash);
+	if (time() > (IntVal($x[0]) + $max_livetime)) return false;
+	
+	$sec_hash = hash('whirlpool', $a->user["guid"] . $a->user["prvkey"] . session_id() . $x[0] . $typename);
+	
+	return ($sec_hash == $x[1]);
+}
+
+function check_form_security_std_err_msg() {
+	return t('The form security token was not correct. This probably happened because the form has been opened for too long (>3 hours) before subitting it.') . EOL;
+}
+function check_form_security_token_redirectOnErr($err_redirect, $typename = "", $formname = 'form_security_token') {
+	if (!check_form_security_token($typename, $formname)) {
+		$a = get_app();
+		notice( check_form_security_std_err_msg() );
+		goaway($a->get_baseurl() . $err_redirect );
+	}
+}

include/template_processor.php

@@ -80,8 +80,13 @@
 		 */
 		private function _replcb_for($args){
 			$m = array_map('trim', explode(" as ", $args[2]));
-			list($keyname, $varname) = explode("=>",$m[1]);
-			if (is_null($varname)) { $varname=$keyname; $keyname=""; }
+			$x = explode("=>",$m[1]);
+			if (count($x) == 1) {
+				$varname = $x[0];
+				$keyname = "";
+			} else {
+				list($keyname, $varname) = $x;
+			}
 			if ($m[0]=="" || $varname=="" || is_null($varname)) die("template error: 'for ".$m[0]." as ".$varname."'") ;
 			//$vals = $this->r[$m[0]];
 			$vals = $this->_get_var($m[0]);