Changeset 13086

Timestamp:

May 11, 2013, 2:54:00 PM (11 years ago)

Author:

Steffen Hoffmann

Message:

VotePlugin: Insert and evaluate tokens to prevent CSFR attacks, refs #7744.

Code has been re-used from Trac core, and I've been lucky to get pre-commit
review of these changes by Ryan J Ollos, who provided the simpler set_vote.

Location:

voteplugin/trunk/tracvote

Files:

• __init__.py (modified) (2 diffs)
• htdocs/js/tracvote.js (modified) (1 diff)

voteplugin/trunk/tracvote/__init__.py

@@ -361 +361 @@
         old_vote = self.get_vote(req, resource)
 
-        if old_vote == vote:
-            vote = 0
-            self.set_vote(req, resource, 0)
+        # Protect against CSRF attacks: Validate the token like done in Trac
+        # core for all POST requests with a content-type corresponding
+        # to form submissions.
+        msg = ''
+        if req.args.get('token') != req.form_token:
+            if self.env.secure_cookies and req.scheme == 'http':
+                msg = ("Secure cookies are enabled, you must use https for "
+                       "your requests.")
+            else:
+                msg = ("Do you have cookies enabled?")
+            raise TracError(msg)
         else:
+            if old_vote == vote:
+                # Second click on same icon revokes previous vote.
+                vote = 0
             self.set_vote(req, resource, vote)
 
@@ -582 +593 @@
                      alt='Up-vote')
         down = tag.img(src=req.href.chrome('vote/' + self.image_map[vote][1]),
-                     alt='Down-vote')
+                       alt='Down-vote')
         if not 'action' in req.args and 'VOTE_MODIFY' in req.perm and \
                 get_reporter_id(req) != 'anonymous':
             down = tag.a(down, id='downvote',
-                         href=req.href.vote('down', path),
+                         href=req.href.vote('down', path,
+                                            token=req.form_token),
                          title='Down-vote')
-            up = tag.a(up, id='upvote', href=req.href.vote('up', path),
+            up = tag.a(up, id='upvote',
+                       href=req.href.vote('up', path, token=req.form_token),
                        title='Up-vote')
             add_script(req, 'vote/js/tracvote.js')

voteplugin/trunk/tracvote/htdocs/js/tracvote.js

@@ -1 +1 @@
 $(document).ready(function() {
   $('#upvote, #downvote').click(function() {
-  var button = this;
+    var button = this;
+    var href;
+    if (this.href.indexOf('?') === -1) {
+      href = this.href + '?js=1';
+    } else {
+      href = this.href + '&js=1';
+    }
 
-    $.get(this.href + '?js=1', function(result) {
+    $.get(href, function(result) {
       result = result.split(':');