mirror of
https://github.com/friendica/friendica
synced 2024-05-22 06:34:59 +02:00
Add form security token check to /babel module
- This prevents basic XSS attacks against /babel
This commit is contained in:
parent
15b757e36c
commit
aeffcc0ae3
|
@ -43,10 +43,11 @@ class Babel extends BaseModule
|
||||||
}
|
}
|
||||||
|
|
||||||
$results = [];
|
$results = [];
|
||||||
if (!empty($_REQUEST['text'])) {
|
if (!empty($request['text'])) {
|
||||||
switch (($_REQUEST['type'] ?? '') ?: 'bbcode') {
|
self::checkFormSecurityTokenForbiddenOnError('babel');
|
||||||
|
switch (($request['type'] ?? '') ?: 'bbcode') {
|
||||||
case 'bbcode':
|
case 'bbcode':
|
||||||
$bbcode = $_REQUEST['text'];
|
$bbcode = $request['text'];
|
||||||
$results[] = [
|
$results[] = [
|
||||||
'title' => DI::l10n()->t('Source input'),
|
'title' => DI::l10n()->t('Source input'),
|
||||||
'content' => visible_whitespace($bbcode)
|
'content' => visible_whitespace($bbcode)
|
||||||
|
@ -136,7 +137,7 @@ class Babel extends BaseModule
|
||||||
];
|
];
|
||||||
break;
|
break;
|
||||||
case 'diaspora':
|
case 'diaspora':
|
||||||
$diaspora = trim($_REQUEST['text']);
|
$diaspora = trim($request['text']);
|
||||||
$results[] = [
|
$results[] = [
|
||||||
'title' => DI::l10n()->t('Source input (Diaspora format)'),
|
'title' => DI::l10n()->t('Source input (Diaspora format)'),
|
||||||
'content' => visible_whitespace($diaspora),
|
'content' => visible_whitespace($diaspora),
|
||||||
|
@ -144,7 +145,7 @@ class Babel extends BaseModule
|
||||||
|
|
||||||
$markdown = XML::unescape($diaspora);
|
$markdown = XML::unescape($diaspora);
|
||||||
case 'markdown':
|
case 'markdown':
|
||||||
$markdown = $markdown ?? trim($_REQUEST['text']);
|
$markdown = $markdown ?? trim($request['text']);
|
||||||
|
|
||||||
$results[] = [
|
$results[] = [
|
||||||
'title' => DI::l10n()->t('Source input (Markdown)'),
|
'title' => DI::l10n()->t('Source input (Markdown)'),
|
||||||
|
@ -169,7 +170,7 @@ class Babel extends BaseModule
|
||||||
];
|
];
|
||||||
break;
|
break;
|
||||||
case 'html' :
|
case 'html' :
|
||||||
$html = trim($_REQUEST['text']);
|
$html = trim($request['text']);
|
||||||
$results[] = [
|
$results[] = [
|
||||||
'title' => DI::l10n()->t('Raw HTML input'),
|
'title' => DI::l10n()->t('Raw HTML input'),
|
||||||
'content' => visible_whitespace($html),
|
'content' => visible_whitespace($html),
|
||||||
|
@ -239,7 +240,7 @@ class Babel extends BaseModule
|
||||||
];
|
];
|
||||||
break;
|
break;
|
||||||
case 'twitter':
|
case 'twitter':
|
||||||
$json = trim($_REQUEST['text']);
|
$json = trim($request['text']);
|
||||||
|
|
||||||
if (file_exists('addon/twitter/twitter.php')) {
|
if (file_exists('addon/twitter/twitter.php')) {
|
||||||
require_once 'addon/twitter/twitter.php';
|
require_once 'addon/twitter/twitter.php';
|
||||||
|
@ -302,13 +303,14 @@ class Babel extends BaseModule
|
||||||
$tpl = Renderer::getMarkupTemplate('babel.tpl');
|
$tpl = Renderer::getMarkupTemplate('babel.tpl');
|
||||||
$o = Renderer::replaceMacros($tpl, [
|
$o = Renderer::replaceMacros($tpl, [
|
||||||
'$title' => DI::l10n()->t('Babel Diagnostic'),
|
'$title' => DI::l10n()->t('Babel Diagnostic'),
|
||||||
'$text' => ['text', DI::l10n()->t('Source text'), $_REQUEST['text'] ?? '', ''],
|
'$form_security_token' => self::getFormSecurityToken('babel'),
|
||||||
'$type_bbcode' => ['type', DI::l10n()->t('BBCode'), 'bbcode', '', (($_REQUEST['type'] ?? '') ?: 'bbcode') == 'bbcode'],
|
'$text' => ['text', DI::l10n()->t('Source text'), $request['text'] ?? '', ''],
|
||||||
'$type_diaspora' => ['type', DI::l10n()->t('Diaspora'), 'diaspora', '', (($_REQUEST['type'] ?? '') ?: 'bbcode') == 'diaspora'],
|
'$type_bbcode' => ['type', DI::l10n()->t('BBCode'), 'bbcode', '', (($request['type'] ?? '') ?: 'bbcode') == 'bbcode'],
|
||||||
'$type_markdown' => ['type', DI::l10n()->t('Markdown'), 'markdown', '', (($_REQUEST['type'] ?? '') ?: 'bbcode') == 'markdown'],
|
'$type_diaspora' => ['type', DI::l10n()->t('Diaspora'), 'diaspora', '', (($request['type'] ?? '') ?: 'bbcode') == 'diaspora'],
|
||||||
'$type_html' => ['type', DI::l10n()->t('HTML'), 'html', '', (($_REQUEST['type'] ?? '') ?: 'bbcode') == 'html'],
|
'$type_markdown' => ['type', DI::l10n()->t('Markdown'), 'markdown', '', (($request['type'] ?? '') ?: 'bbcode') == 'markdown'],
|
||||||
|
'$type_html' => ['type', DI::l10n()->t('HTML'), 'html', '', (($request['type'] ?? '') ?: 'bbcode') == 'html'],
|
||||||
'$flag_twitter' => file_exists('addon/twitter/twitter.php'),
|
'$flag_twitter' => file_exists('addon/twitter/twitter.php'),
|
||||||
'$type_twitter' => ['type', DI::l10n()->t('Twitter Source / Tweet URL (requires API key)'), 'twitter', '', (($_REQUEST['type'] ?? '') ?: 'bbcode') == 'twitter'],
|
'$type_twitter' => ['type', DI::l10n()->t('Twitter Source / Tweet URL (requires API key)'), 'twitter', '', (($request['type'] ?? '') ?: 'bbcode') == 'twitter'],
|
||||||
'$results' => $results,
|
'$results' => $results,
|
||||||
'$submit' => DI::l10n()->t('Submit'),
|
'$submit' => DI::l10n()->t('Submit'),
|
||||||
]);
|
]);
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
<div id="babel" class="generic-page-wrapper">
|
<div id="babel" class="generic-page-wrapper">
|
||||||
<h2>{{$title}}</h2>
|
<h2>{{$title}}</h2>
|
||||||
<form action="babel" method="post" class="panel panel-default">
|
<form action="babel" method="post" class="panel panel-default">
|
||||||
|
<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
|
||||||
<div class="panel-body">
|
<div class="panel-body">
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
{{include file="field_textarea.tpl" field=$text}}
|
{{include file="field_textarea.tpl" field=$text}}
|
||||||
|
@ -30,4 +31,4 @@
|
||||||
{{/foreach}}
|
{{/foreach}}
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
{{/if}}
|
{{/if}}
|
||||||
|
|
Loading…
Reference in a new issue