Implement CSRF

2026-05-28 13:22:44 +02:00
parent 8092846d6f
commit fdd0ada815
14 changed files with 129 additions and 106 deletions
--- a/lib/Media.php
+++ b/lib/Media.php
@@ -167,7 +167,7 @@ class Media extends PhpObject {
 					'-print_format json', //output format: json
 					'-i' //input file
 				));
-				exec('ffprobe '.$sParams.' "'.$sMediaPath.'"', $asResult);
+				exec('ffprobe '.$sParams.' '.escapeshellarg($sMediaPath), $asResult);
 				$asExif = json_decode(implode('', $asResult), true);

 				//Taken On
@@ -269,10 +269,10 @@ class Media extends PhpObject {
 					$sTempPath = self::getMediaPath(uniqid('temp_').'.png');
 					$asResult = array();
 					$sParams = implode(' ', array(
-						'-i "'.$sMediaPath.'"',	//input file
-						'-ss 00:00:01.000',		//Image taken after x seconds
-						'-vframes 1',			//number of video frames to output
-						'"'.$sTempPath.'"',		//output file
+						'-i '.escapeshellarg($sMediaPath),	//input file
+						'-ss 00:00:01.000',					//Image taken after x seconds
+						'-vframes 1',						//number of video frames to output
+						escapeshellarg($sTempPath),			//output file
 					));
 					exec('ffmpeg '.$sParams, $asResult);

@@ -296,7 +296,8 @@ class Media extends PhpObject {
 		$sMediaPath = self::getMediaPath($sMediaName);
 		$sMediaMime = mime_content_type($sMediaPath);
 		switch($sMediaMime) {
-			case 'video/quicktime':	$sType = 'video';	break;
+			case 'video/quicktime':
+			case 'video/mp4':		$sType = 'video';	break;
 			default:				$sType = 'image';	break;
 		}

--- a/lib/Spot.php
+++ b/lib/Spot.php
@@ -46,6 +46,19 @@ class Spot extends Main
 	const MAIN_PAGE = 'index';

 	const DIST_FOLDER = '../dist/';
+	const MUTATING_ACTIONS = array(
+		'add_post',
+		'subscribe',
+		'unsubscribe',
+		'update_project',
+		'upload',
+		'add_comment',
+		'add_position',
+		'admin_set',
+		'admin_create',
+		'admin_delete',
+		'build_geojson'
+	);

 	private Project $oProject;
 	private Media $oMedia;
@@ -186,7 +199,8 @@ class Spot extends Main
 					'chunk_size'				=> self::FEED_CHUNK_SIZE,
 					'hash_sep'					=> '-',
 					'title'						=> self::PROJECT_NAME,
-					'default_page'				=> 'project'
+					'default_page'				=> 'project',
+					'csrf_token'				=> $this->getCsrfToken()
 				)
 			),
 			self::MAIN_PAGE,
@@ -278,17 +292,6 @@ class Spot extends Main
 		return $oEmail->send();
 	}

-	public function genCronFile() {
-		//$bSuccess = (file_put_contents('spot_cron.sh', '#!/bin/bash'."\n".'cd '.dirname($_SERVER['SCRIPT_FILENAME'])."\n".'php -f index.php a=update_feed')!==false);
-		$sFileName = 'spot_cron.sh';
-		$sContent =
-			'#!/bin/bash'."\n".
-			'wget -qO- '.$this->asContext['serv_name'].'index.php?a=update_project > /dev/null'."\n".
-			'#Crontab job: 0 * * * * . '.dirname($_SERVER['SCRIPT_FILENAME']).'/'.$sFileName.' > /dev/null'."\n";
-		$bSuccess = (file_put_contents($sFileName, $sContent)!==false);
-		return self::getJsonResult($bSuccess, '');
-	}
-
 	public function getMarkers($asMessageIds=array(), $asMediaIds=array(), $bInternal=false)
 	{
 		//Get messages
@@ -579,10 +582,10 @@ class Spot extends Main
 		return $bInternal?$asResult['feed']:self::getJsonResult(true, '', $asResult);
 	}

-	public function getFeed($iRefId=0, $sDirection, $sSort) {
-		$this->oDb->cleanSql($iRefId);
-		$this->oDb->cleanSql($sDirection);
-		$this->oDb->cleanSql($sSort);
+	private function getFeed($iRefId, $sDirection, $sSort) {
+		$sRefId = is_scalar($iRefId) && preg_match('/^\d+(?:\.\d+)?$/D', (string) $iRefId) ? (string) $iRefId : '0';
+		$sDirection = ($sDirection === '>')?'>':'<';
+		$sSort = ($sSort === 'ASC')?'ASC':'DESC';

 		$sProjectIdField = Db::getId(Project::PROJ_TABLE);
 		$sMsgIdField = Db::getId(Feed::MSG_TABLE);
@@ -605,7 +608,7 @@ class Spot extends Main
 				"FROM ".self::POST_TABLE,
 				$this->getFeedConstraints(self::POST_TABLE, 'site_time', 'sql'),
 			") AS items",
-			($iRefId > 0)?("WHERE ref ".$sDirection." ".$iRefId):"",
+			($sRefId !== '0')?("WHERE ref ".$sDirection." ".$sRefId):"",
 			"ORDER BY ref ".$sSort,
 			"LIMIT ".self::FEED_CHUNK_SIZE
 		));
--- a/lib/Uploader.php
+++ b/lib/Uploader.php
@@ -46,12 +46,15 @@ class Uploader extends UploadHandler
 	}

 	protected function handle_file_upload($uploaded_file, $name, $size, $type, $error, $index = null, $content_range = null) {
-		$file = parent::handle_file_upload($uploaded_file, $name, $size, $type, $error, $index, $content_range);
+		$sExt = strtolower(pathinfo((string) $name, PATHINFO_EXTENSION));
+		$sStoredName = bin2hex(random_bytes(16)).($sExt !== ''?'.'.$sExt:'');
+		$file = parent::handle_file_upload($uploaded_file, $sStoredName, $size, $type, $error, $index, $content_range);

 		if(empty($file->error)) {
 			$asResult = $this->oMedia->addMedia($file->name);
 			if(!$asResult['result']) $file->error = $this->get_error_message($asResult['desc'], $asResult['data']);
 			else {
+				$file->original_name = basename((string) $name);
 				$file->id = $this->oMedia->getMediaId();
 				$file->thumbnail = $asResult['data']['thumb_path'];
 			}
--- a/lib/index.php
+++ b/lib/index.php
@@ -9,33 +9,36 @@ ob_start();
 $oLoader = require __DIR__.'/../vendor/autoload.php';

 use Franzz\Objects\ToolBox;
-use Franzz\Objects\Main;
 use Franzz\Spot\Spot;
 use Franzz\Spot\User;

 ToolBox::fixGlobalVars($argv ?? array());

 //Available variables
-$sAction	= $_REQUEST['a']			?? '';
-$sTimezone	= $_REQUEST['t']			?? '';
-$sName		= $_GET['name']				?? '';
-$sContent	= $_GET['content']			?? '';
-$iProjectId	= $_REQUEST['id_project']	?? 0 ;
-$sField		= $_REQUEST['field']		?? '';
-$oValue		= $_REQUEST['value']		?? '';
-$iId		= $_REQUEST['id']			?? 0 ;
-$sType		= $_REQUEST['type']			?? '';
-$sEmail		= $_REQUEST['email']		?? '';
-$sLat		= $_REQUEST['latitude']		?? '';
-$sLng		= $_REQUEST['longitude']	?? '';
-$iTimestamp = $_REQUEST['timestamp']	?? 0;
+$sAction		= $_REQUEST['a']			?? '';
+$sTimezone		= $_REQUEST['t']			?? '';
+$sName			= $_REQUEST['name']			?? '';
+$sContent		= $_REQUEST['content']		?? '';
+$iProjectId		= Spot::validatePositiveInt($_REQUEST['id_project'] ?? 0);
+$sRefId			= $_REQUEST['id']			?? 0;
+$iEntityId		= Spot::validatePositiveInt($_REQUEST['id'] ?? 0);
+$sField			= $_REQUEST['field']		?? '';
+$oValue			= $_REQUEST['value']		?? '';
+$sType			= $_REQUEST['type']			?? '';
+$sEmail			= $_REQUEST['email']		?? '';
+$sLat			= $_REQUEST['latitude']		?? '';
+$sLng			= $_REQUEST['longitude']	?? '';
+$iTimestamp		= Spot::validatePositiveInt($_REQUEST['timestamp'] ?? 0);
+$sCsrfToken		= $_SERVER['HTTP_X_CSRF_TOKEN'] ?? ($_POST['csrf_token'] ?? '');

 //Initiate class
 $oSpot = new Spot(__FILE__, $sTimezone);
 $oSpot->setProjectId($iProjectId);

-$sResult = '';
-if($sAction!='')
+$bValidRequest = $oSpot->validateMutationRequest($sAction, $sCsrfToken);
+if(!$bValidRequest) $sResult = Spot::getJsonResult(false, Spot::UNAUTHORIZED);
+elseif($sAction == '') $sResult = $oSpot->getAppMainPage();
+else
 {
 	switch($sAction)
 	{
@@ -49,10 +52,10 @@ if($sAction!='')
 			$sResult = $oSpot->getProjectGeoJson();
 			break;
 		case 'next_feed':
-			$sResult = $oSpot->getNextFeed($iId);
+			$sResult = $oSpot->getNextFeed($sRefId);
 			break;
 		case 'new_feed':
-			$sResult = $oSpot->getNewFeed($iId);
+			$sResult = $oSpot->getNewFeed($sRefId);
 			break;
 		case 'add_post':
 			$sResult = $oSpot->addPost($sName, $sContent);
@@ -64,7 +67,7 @@ if($sAction!='')
 			$sResult = $oSpot->unsubscribe();
 			break;
 		case 'unsubscribe_email':
-			$sResult = $oSpot->unsubscribeFromEmail($iId);
+			$sResult = $oSpot->unsubscribeFromEmail($iEntityId);
 			break;
 		case 'update_project':
 			$sResult = $oSpot->updateProject();
@@ -78,7 +81,7 @@ if($sAction!='')
 						$sResult = $oSpot->upload();
 						break;
 					case 'add_comment':
-						$sResult = $oSpot->addComment($iId, $sContent);
+						$sResult = $oSpot->addComment($iEntityId, $sContent);
 						break;
 					case 'add_position':
 						$sResult = $oSpot->addPosition($sLat, $sLng, $iTimestamp);
@@ -87,16 +90,13 @@ if($sAction!='')
 						$sResult = $oSpot->getAdminSettings();
 						break;
 					case 'admin_set':
-						$sResult = $oSpot->setAdminSettings($sType, $iId, $sField, $oValue);
+						$sResult = $oSpot->setAdminSettings($sType, $iEntityId, $sField, $oValue);
 						break;
 					case 'admin_create':
 						$sResult = $oSpot->createAdminSettings($sType);
 						break;
 					case 'admin_delete':
-						$sResult = $oSpot->deleteAdminSettings($sType, $iId);
-						break;
-					case 'generate_cron':
-						$sResult = $oSpot->genCronFile();
+						$sResult = $oSpot->deleteAdminSettings($sType, $iEntityId);
 						break;
 					case 'sql':
 						$sResult = $oSpot->getDbBuildScript();
@@ -105,13 +105,12 @@ if($sAction!='')
 						$sResult = $oSpot->buildGeoJSON($sName);
 						break;
 					default:
-						$sResult = Main::getJsonResult(false, Main::NOT_FOUND);
+						$sResult = Spot::getJsonResult(false, Spot::NOT_FOUND);
 				}
 			}
-			else $sResult = Main::getJsonResult(false, Main::NOT_FOUND);
+			else $sResult = Spot::getJsonResult(false, Spot::NOT_FOUND);
 	}
 }
-else $sResult = $oSpot->getAppMainPage();

 $sDebug = ob_get_clean();
 if(Settings::DEBUG && $sDebug!='') $oSpot->addUncaughtError($sDebug);