Contacts: Implement CSRF prevention.

diff --git a/apps/contacts/ajax/activation.php b/apps/contacts/ajax/activation.php
index 388a3b5438c6d35fc8e8148bddd37764f62a01df..74cb738ab8fccb39fce648f033d6692151442475 100644 (file)
--- a/apps/contacts/ajax/activation.php
+++ b/apps/contacts/ajax/activation.php
@@ -10,6 +10,7 @@
  
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 $bookid = $_POST['bookid'];
 $book = OC_Contacts_App::getAddressbook($bookid);// is owner access check

diff --git a/apps/contacts/ajax/addcontact.php b/apps/contacts/ajax/addcontact.php
index ee451098f1dad6185a76b3c308ec437ca12d88e2..d15ad8c6216b1ace305942663e42defa8a55f678 100644 (file)
--- a/apps/contacts/ajax/addcontact.php
+++ b/apps/contacts/ajax/addcontact.php
@@ -27,17 +27,11 @@ function bailOut($msg) {
        OCP\Util::writeLog('contacts','ajax/addcontact.php: '.$msg, OCP\Util::DEBUG);
        exit();
 }
-function debug($msg) {
-       OCP\Util::writeLog('contacts','ajax/addcontact.php: '.$msg, OCP\Util::DEBUG);
-}
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
-
-foreach ($_POST as $key=>$element) {
-       debug('_POST: '.$key.'=>'.$element);
-}
+OCP\JSON::callCheck();
 
 $aid = isset($_POST['aid'])?$_POST['aid']:null;
 if(!$aid) {

diff --git a/apps/contacts/ajax/addproperty.php b/apps/contacts/ajax/addproperty.php
index 97d38397fd18fa010248787ba636765cc70d88be..be9e849be721dc8258d962573cb1428c29bd6516 100644 (file)
--- a/apps/contacts/ajax/addproperty.php
+++ b/apps/contacts/ajax/addproperty.php
@@ -26,6 +26,7 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 function bailOut($msg) {
        OCP\JSON::error(array('data' => array('message' => $msg)));

diff --git a/apps/contacts/ajax/createaddressbook.php b/apps/contacts/ajax/createaddressbook.php
index af7c19eef519f2aed3300022fdf351c43c204fe6..616766bb1a0c18c02d09da08606e9da954414168 100644 (file)
--- a/apps/contacts/ajax/createaddressbook.php
+++ b/apps/contacts/ajax/createaddressbook.php
@@ -11,6 +11,7 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 $userid = OCP\USER::getUser();
 $name = trim(strip_tags($_POST['name']));

diff --git a/apps/contacts/ajax/cropphoto.php b/apps/contacts/ajax/cropphoto.php
index 7b286dbdb5283adf8a07a0fca54a70d8384e8a71..7006c6fc1ffd846b6f733777b7b2e87d05a1d1e8 100644 (file)
--- a/apps/contacts/ajax/cropphoto.php
+++ b/apps/contacts/ajax/cropphoto.php
@@ -27,12 +27,14 @@
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
 
-$tmp_path = $_GET['tmp_path'];
+$tmp_path = strip_tags($_GET['tmp_path']);
+$requesttoken = strip_tags($_GET['requesttoken']);
 $id = $_GET['id'];
 OCP\Util::writeLog('contacts','ajax/cropphoto.php: tmp_path: '.$tmp_path.', exists: '.file_exists($tmp_path), OCP\Util::DEBUG);
 $tmpl = new OCP\Template("contacts", "part.cropphoto");
 $tmpl->assign('tmp_path', $tmp_path);
 $tmpl->assign('id', $id);
+$tmpl->assign('requesttoken', $requesttoken);
 $page = $tmpl->fetchPage();
 
 OCP\JSON::success(array('data' => array( 'page' => $page )));

diff --git a/apps/contacts/ajax/deletebook.php b/apps/contacts/ajax/deletebook.php
index bcf6aa4432967f78135fe16a033cc42be8000ace..4520374a23b1b2859663c220301391f39efd89bc 100644 (file)
--- a/apps/contacts/ajax/deletebook.php
+++ b/apps/contacts/ajax/deletebook.php
@@ -26,6 +26,7 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 //$id = $_GET['id'];
 $id = $_POST['id'];

diff --git a/apps/contacts/ajax/deletecard.php b/apps/contacts/ajax/deletecard.php
index 98ff06ebe7a5ac31c22bdeaa3a2e76defa3e3a63..f998185be416700f40d7374e1fa10cfb3ce43a92 100644 (file)
--- a/apps/contacts/ajax/deletecard.php
+++ b/apps/contacts/ajax/deletecard.php
@@ -31,6 +31,7 @@ function bailOut($msg) {
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 $id = isset($_POST['id'])?$_POST['id']:null;
 if(!$id) {

diff --git a/apps/contacts/ajax/deleteproperty.php b/apps/contacts/ajax/deleteproperty.php
index a1372870344e1b4a8643ca335142bf9a9027c5ee..95fd43e0d95c91e460d86b6efc0dd9ff3d1402ea 100644 (file)
--- a/apps/contacts/ajax/deleteproperty.php
+++ b/apps/contacts/ajax/deleteproperty.php
@@ -26,6 +26,7 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 $id = $_POST['id'];
 $checksum = $_POST['checksum'];

diff --git a/apps/contacts/ajax/oc_photo.php b/apps/contacts/ajax/oc_photo.php
index 184217f2b72f015ee72939f03afd2ecfce114403..903d2aedfbe13b545b4f7b179eb16801bf2ad9ce 100644 (file)
--- a/apps/contacts/ajax/oc_photo.php
+++ b/apps/contacts/ajax/oc_photo.php
@@ -24,6 +24,7 @@
 OCP\JSON::setContentTypeHeader('text/plain');
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 function bailOut($msg) {
        OCP\JSON::error(array('data' => array('message' => $msg)));
        OCP\Util::writeLog('contacts','ajax/oc_photo.php: '.$msg, OCP\Util::ERROR);

diff --git a/apps/contacts/ajax/savecrop.php b/apps/contacts/ajax/savecrop.php
index fe9e5c5b99190ade5f0d59f84f8f2bfed96a7a50..263361bafc1c384e15abc9d5a4a83bdba3fad30b 100644 (file)
--- a/apps/contacts/ajax/savecrop.php
+++ b/apps/contacts/ajax/savecrop.php
@@ -21,13 +21,26 @@
  * TODO: Translatable strings.
  *       Remember to delete tmp file at some point.
  */
-// Init owncloud
  
-OCP\Util::writeLog('contacts','ajax/savecrop.php: Huzzah!!!', OCP\Util::DEBUG);
+function bailOut($msg) {
+       OCP\JSON::error(array('data' => array('message' => $msg)));
+       OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$msg, OCP\Util::DEBUG);
+       exit();
+}
+function debug($msg) {
+       OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$msg, OCP\Util::DEBUG);
+}
 
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+foreach($_POST as $key=>$value) {
+       debug('POST: '.$key.'=>'.$value);
+}
+foreach($_GET as $key=>$value) {
+       debug('GET: '.$key.'=>'.$value);
+}
+OCP\JSON::callCheck();
 
 // foreach ($_POST as $key=>$element) {
 //     OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$key.'=>'.$element, OCP\Util::DEBUG);
@@ -36,12 +49,6 @@ OCP\JSON::checkAppEnabled('contacts');
 // Firefox and Konqueror tries to download application/json for me.  --Arthur
 OCP\JSON::setContentTypeHeader('text/plain');
 
-function bailOut($msg) {
-       OCP\JSON::error(array('data' => array('message' => $msg)));
-       OCP\Util::writeLog('contacts','ajax/savecrop.php: '.$msg, OCP\Util::DEBUG);
-       exit();
-}
-
 $image = null;
 
 $x1 = (isset($_POST['x1']) && $_POST['x1']) ? $_POST['x1'] : 0;

diff --git a/apps/contacts/ajax/saveproperty.php b/apps/contacts/ajax/saveproperty.php
index 6509ac21f280d959de9a4815de1e98ffbe0c3767..96e082d00e911c3a3e9812ebf98ccd22dc26649f 100644 (file)
--- a/apps/contacts/ajax/saveproperty.php
+++ b/apps/contacts/ajax/saveproperty.php
@@ -26,6 +26,7 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 function bailOut($msg) {
        OCP\JSON::error(array('data' => array('message' => $msg)));

diff --git a/apps/contacts/ajax/updateaddressbook.php b/apps/contacts/ajax/updateaddressbook.php
index 19b5b3bddce55ed9f0e299ed4bb1282778b1bb14..68fe8f81211b796561ba278ea0717b8a320e6923 100644 (file)
--- a/apps/contacts/ajax/updateaddressbook.php
+++ b/apps/contacts/ajax/updateaddressbook.php
@@ -11,6 +11,7 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 
 $bookid = $_POST['id'];
 OC_Contacts_App::getAddressbook($bookid); // is owner access check

diff --git a/apps/contacts/ajax/uploadimport.php b/apps/contacts/ajax/uploadimport.php
index b11f380fa8a885322bf0d766db2dd1842b72128f..4c3f5eadf08f8152b6a65a849fce925b5afa77a0 100644 (file)
--- a/apps/contacts/ajax/uploadimport.php
+++ b/apps/contacts/ajax/uploadimport.php
@@ -23,14 +23,12 @@
 // Check if we are a user
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('contacts');
+OCP\JSON::callCheck();
 function bailOut($msg) {
        OCP\JSON::error(array('data' => array('message' => $msg)));
        OCP\Util::writeLog('contacts','ajax/uploadimport.php: '.$msg, OCP\Util::ERROR);
        exit();
 }
-function debug($msg) {
-       OCP\Util::writeLog('contacts','ajax/uploadimport.php: '.$msg, OCP\Util::DEBUG);
-}
 
 $view = OCP\Files::getStorage('contacts');
 $tmpfile = md5(rand());
@@ -39,7 +37,6 @@ $tmpfile = md5(rand());
 $fn = (isset($_SERVER['HTTP_X_FILE_NAME']) ? $_SERVER['HTTP_X_FILE_NAME'] : false);
 if($fn) {
        if($view->file_put_contents('/'.$tmpfile, file_get_contents('php://input'))) {
-               debug($fn.' uploaded');
                OCP\JSON::success(array('data' => array('path'=>'', 'file'=>$tmpfile)));
                exit();
        } else {
@@ -70,7 +67,6 @@ $file=$_FILES['importfile'];
 $tmpfname = tempnam(get_temp_dir(), "occOrig");
 if(file_exists($file['tmp_name'])) {
        if($view->file_put_contents('/'.$tmpfile, file_get_contents($file['tmp_name']))) {
-               debug($fn.' uploaded');
                OCP\JSON::success(array('data' => array('path'=>'', 'file'=>$tmpfile)));
        } else {
                bailOut(OC_Contacts_App::$l10n->t('Error uploading contacts to storage.'));

diff --git a/apps/contacts/ajax/uploadphoto.php b/apps/contacts/ajax/uploadphoto.php
index dca8ede6d601d4ee70ea0247930fcc9e83dd1231..2dc93362a149bcf7aa8244a1f7be65818eacfee6 100644 (file)
--- a/apps/contacts/ajax/uploadphoto.php
+++ b/apps/contacts/ajax/uploadphoto.php
@@ -19,14 +19,6 @@
  * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
  *
  */
-// Init owncloud
- 
-
-// Check if we are a user
-// Firefox and Konqueror tries to download application/json for me.  --Arthur
-OCP\JSON::setContentTypeHeader('text/plain');
-OCP\JSON::checkLoggedIn();
-OCP\JSON::checkAppEnabled('contacts');
 function bailOut($msg) {
        OCP\JSON::error(array('data' => array('message' => $msg)));
        OCP\Util::writeLog('contacts','ajax/uploadphoto.php: '.$msg, OCP\Util::DEBUG);
@@ -35,6 +27,16 @@ function bailOut($msg) {
 function debug($msg) {
        OCP\Util::writeLog('contacts','ajax/uploadphoto.php: '.$msg, OCP\Util::DEBUG);
 }
+OCP\JSON::setContentTypeHeader('text/plain');
+OCP\JSON::checkLoggedIn();
+OCP\JSON::checkAppEnabled('contacts');
+foreach($_POST as $key=>$value) {
+       debug('POST: '.$key.'=>'.$value);
+}
+foreach($_GET as $key=>$value) {
+       debug('GET: '.$key.'=>'.$value);
+}
+OCP\JSON::callCheck();
 
 // If it is a Drag'n'Drop transfer it's handled here.
 $fn = (isset($_SERVER['HTTP_X_FILE_NAME']) ? $_SERVER['HTTP_X_FILE_NAME'] : false);

diff --git a/apps/contacts/js/contacts.js b/apps/contacts/js/contacts.js
index 4f8f3743dc4eb300399408edda4041aecb8eab32..436599568697d6292cf557a7d866a7ef0eddd27c 100644 (file)
--- a/apps/contacts/js/contacts.js
+++ b/apps/contacts/js/contacts.js
@@ -1150,7 +1150,7 @@ Contacts={
                        },
                        editPhoto:function(id, tmp_path){
                                //alert('editPhoto: ' + tmp_path);
-                               $.getJSON(OC.filePath('contacts', 'ajax', 'cropphoto.php'),{'tmp_path':tmp_path,'id':this.id},function(jsondata){
+                               $.getJSON(OC.filePath('contacts', 'ajax', 'cropphoto.php'),{'tmp_path':tmp_path,'id':this.id,'requesttoken':requesttoken},function(jsondata){
                                        if(jsondata.status == 'success'){
                                                //alert(jsondata.data.page);
                                                $('#edit_photo_dialog_img').html(jsondata.data.page);
@@ -1637,7 +1637,7 @@ $(document).ready(function(){
                                //}
                        }
                };
-               xhr.open('POST', OC.filePath('contacts', 'ajax', 'uploadphoto.php')+'?id='+Contacts.UI.Card.id+'&imagefile='+encodeURIComponent(file.name), true);
+               xhr.open('POST', OC.filePath('contacts', 'ajax', 'uploadphoto.php')+'?id='+Contacts.UI.Card.id+'&requesttoken='+requesttoken+'&imagefile='+encodeURIComponent(file.name), true);
                xhr.setRequestHeader('Cache-Control', 'no-cache');
                xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
                xhr.setRequestHeader('X_FILE_NAME', encodeURIComponent(file.name));

diff --git a/apps/contacts/templates/part.contact.php b/apps/contacts/templates/part.contact.php
index 74522be37c41333712fd7f618547e01cf0e307a1..9a13aafa5e3820bddd98c69b2a8991e6c61ef49b 100644 (file)
--- a/apps/contacts/templates/part.contact.php
+++ b/apps/contacts/templates/part.contact.php
@@ -4,6 +4,7 @@ $id = isset($_['id']) ? $_['id'] : '';
 <div id="card">
        <form class="float" id="file_upload_form" action="<?php echo OCP\Util::linkTo('contacts', 'ajax/uploadphoto.php'); ?>" method="post" enctype="multipart/form-data" target="file_upload_target">
                <input type="hidden" name="id" value="<?php echo $_['id'] ?>">
+               <input type="hidden" name="requesttoken" value="<?php echo $_['requesttoken'] ?>">
                <input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $_['uploadMaxFilesize'] ?>" id="max_upload">
                <input type="hidden" class="max_human_file_size" value="(max <?php echo $_['uploadMaxHumanFilesize']; ?>)">
                <input id="file_upload_start" type="file" accept="image/*" name="imagefile" />

diff --git a/apps/contacts/templates/part.cropphoto.php b/apps/contacts/templates/part.cropphoto.php
index 599951d9a972fb8096dfc083c99488414c635183..e10721791304c42d88299bec0a1283cf0891f970 100644 (file)
--- a/apps/contacts/templates/part.cropphoto.php
+++ b/apps/contacts/templates/part.cropphoto.php
@@ -1,6 +1,7 @@
 <?php 
 $id = $_['id'];
 $tmp_path = $_['tmp_path'];
+$requesttoken = $_['requesttoken'];
 OCP\Util::writeLog('contacts','templates/part.cropphoto.php: tmp_path: '.$tmp_path.', exists: '.file_exists($tmp_path), OCP\Util::DEBUG);
 ?>
 <script language="Javascript">
@@ -47,6 +48,7 @@ OCP\Util::writeLog('contacts','templates/part.cropphoto.php: tmp_path: '.$tmp_pa
        action="<?php echo OCP\Util::linkToAbsolute('contacts', 'ajax/savecrop.php'); ?>">
 
        <input type="hidden" id="id" name="id" value="<?php echo $id; ?>" />
+       <input type="hidden" id="requesttoken" name="requesttoken" value="<?php echo $requesttoken; ?>" />
        <input type="hidden" id="tmp_path" name="tmp_path" value="<?php echo $tmp_path; ?>" />
        <fieldset id="coords">
        <input type="hidden" id="x1" name="x1" value="" />

diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index f9d879813590532865a994889bbb17b5896fc2ed..25281c452a5be1b21f91105dc6561f93b69d2b63 100644 (file)
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -26,7 +26,7 @@
                <?php endforeach; ?>
                <script type="text/javascript">
                        $(function() {
-                               var requesttoken = '<?php echo $_['requesttoken']; ?>';
+                               requesttoken = '<?php echo $_['requesttoken']; ?>';
                                $(document).bind('ajaxSend', function(elm, xhr, s){
                                        if(requesttoken) {
                                                xhr.setRequestHeader('requesttoken', requesttoken);