Adds XSRF protection to the Lists module.

Signed-off-by: Vincent Zanotti <vincent.zanotti@polytechnique.org>

diff --git a/modules/lists.php b/modules/lists.php
index 95efd3f..22fe67e 100644 (file)
--- a/modules/lists.php
+++ b/modules/lists.php
@@ -98,14 +98,18 @@ class ListsModule extends PLModule
 
 
         if (Get::has('del')) {
+            S::assert_xsrf_token();
             $this->client->unsubscribe(Get::v('del'));
             pl_redirect('lists');
         }
         if (Get::has('add')) {
+            S::assert_xsrf_token();
             $this->client->subscribe(Get::v('add'));
             pl_redirect('lists');
         }
         if (Post::has('promo_add')) {
+            S::assert_xsrf_token();
+
             $promo = Post::i('promo_add');
             if ($promo >= 1900 and $promo < 2100) {
                 $this->client->subscribe("promo$promo");
@@ -113,6 +117,7 @@ class ListsModule extends PLModule
                 $page->trigSuccess("promo incorrecte, il faut une promo sur 4 chiffres.");
             }
         }
+
         $listes = $this->client->get_lists();
         $owner  = array_filter($listes, 'filter_owner');
         $listes = array_diff_key($listes, $owner);
@@ -134,6 +139,8 @@ class ListsModule extends PLModule
         header('Content-Type: text/html; charset="UTF-8"');
         $domain = $this->prepare_client($page);
         $page->changeTpl('lists/liste.inc.tpl', NO_SKIN);
+        S::assert_xsrf_token();
+
         if (Get::has('unsubscribe')) {
             $this->client->unsubscribe($list);
         }
@@ -213,6 +220,8 @@ class ListsModule extends PLModule
 
         if (!Post::has('submit')) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         $asso = Post::v('asso');
@@ -295,11 +304,13 @@ class ListsModule extends PLModule
         $page->changeTpl('lists/members.tpl');
 
         if (Get::has('del')) {
+            S::assert_xsrf_token();
             $this->client->unsubscribe($liste);
             pl_redirect('lists/members/'.$liste);
         }
 
         if (Get::has('add')) {
+            S::assert_xsrf_token();
             $this->client->subscribe($liste);
             pl_redirect('lists/members/'.$liste);
         }
@@ -330,10 +341,12 @@ class ListsModule extends PLModule
         $this->prepare_client($page);
 
         if (Get::has('del')) {
+            S::assert_xsrf_token();
             $this->client->unsubscribe($liste);
             pl_redirect('lists/annu/'.$liste);
         }
         if (Get::has('add')) {
+            S::assert_xsrf_token();
             $this->client->subscribe($liste);
             pl_redirect('lists/annu/'.$liste);
         }
@@ -454,6 +467,8 @@ class ListsModule extends PLModule
         $page->register_modifier('hdc', 'list_header_decode');
 
         if (Env::has('sadd') || Env::has('sdel')) {
+            S::assert_xsrf_token();
+
             if (Env::has('sadd')) { /* 4 = SUBSCRIBE */
                 $sub = $this->client->get_pending_sub($liste, Env::v('sadd'));
                 $this->client->handle_request($liste,Env::v('sadd'),4,'');
@@ -484,6 +499,8 @@ class ListsModule extends PLModule
         }
 
         if (Post::has('moderate_mails') && Post::has('select_mails')) {
+            S::assert_xsrf_token();
+
             $mails = array_keys(Post::v('select_mails'));
             foreach($mails as $mail) {
                 $this->moderate_mail($domain, $liste, $mail);
@@ -568,6 +585,8 @@ class ListsModule extends PLModule
         $page->changeTpl('lists/admin.tpl');
 
         if (Env::has('send_mark')) {
+            S::assert_xsrf_token();
+
             $actions = Env::v('mk_action');
             $uids    = Env::v('mk_uid');
             $mails   = Env::v('mk_email');
@@ -598,6 +617,8 @@ class ListsModule extends PLModule
         }
 
         if (Env::has('add_member')) {
+            S::assert_xsrf_token();
+
             require_once('user.func.inc.php');
             $members = get_users_forlife_list(Env::v('add_member'),
                                               false,
@@ -611,6 +632,8 @@ class ListsModule extends PLModule
         }
 
         if (isset($_FILES['add_member_file']) && $_FILES['add_member_file']['tmp_name']) {
+            S::assert_xsrf_token();
+
             $upload =& PlUpload::get($_FILES['add_member_file'], S::v('forlife'), 'list.addmember', true);
             if (!$upload) {
                 $page->trigError('Une erreur s\'est produite lors du téléchargement du fichier');
@@ -628,6 +651,8 @@ class ListsModule extends PLModule
         }
 
         if (Env::has('del_member')) {
+            S::assert_xsrf_token();
+
             if (strpos(Env::v('del_member'), '@') === false) {
                 $this->client->mass_unsubscribe(
                     $liste, array(Env::v('del_member').'@'.$globals->mail->domain));
@@ -638,6 +663,8 @@ class ListsModule extends PLModule
         }
 
         if (Env::has('add_owner')) {
+            S::assert_xsrf_token();
+
             require_once('user.func.inc.php');
             $owners = get_users_forlife_list(Env::v('add_owner'), false, array('ListsModule', 'no_login_callback'));
             if ($owners) {
@@ -650,6 +677,8 @@ class ListsModule extends PLModule
         }
 
         if (Env::has('del_owner')) {
+            S::assert_xsrf_token();
+
             if (strpos(Env::v('del_owner'), '@') === false) {
                 $this->client->del_owner($liste, Env::v('del_owner').'@'.$globals->mail->domain);
             } else {
@@ -689,6 +718,8 @@ class ListsModule extends PLModule
         $page->changeTpl('lists/options.tpl');
 
         if (Post::has('submit')) {
+            S::assert_xsrf_token();
+
             $values = $_POST;
             $values = array_map('utf8_decode', $values);
             $spamlevel = intval($values['bogo_level']);
@@ -724,8 +755,10 @@ class ListsModule extends PLModule
             }
             $this->client->set_owner_options($liste, $values);
         } elseif (isvalid_email(Post::v('atn_add'))) {
+            S::assert_xsrf_token();
             $this->client->add_to_wl($liste, Post::v('atn_add'));
         } elseif (Get::has('atn_del')) {
+            S::assert_xsrf_token();
             $this->client->del_from_wl($liste, Get::v('atn_del'));
             pl_redirect('lists/options/'.$liste);
         }
@@ -761,6 +794,8 @@ class ListsModule extends PLModule
 
         $page->changeTpl('lists/delete.tpl');
         if (Post::v('valid') == 'OUI') {
+            S::assert_xsrf_token();
+
             if ($this->client->delete_list($liste, Post::b('del_archive'))) {
                 foreach (array('', '-owner', '-admin', '-bounces', '-unsubscribe') as $app) {
                     XDB::execute("DELETE FROM  $table
@@ -793,6 +828,8 @@ class ListsModule extends PLModule
         $page->changeTpl('lists/soptions.tpl');
 
         if (Post::has('submit')) {
+            S::assert_xsrf_token();
+
             $values = $_POST;
             $values = array_map('utf8_decode', $values);
             unset($values['submit']);
@@ -820,6 +857,7 @@ class ListsModule extends PLModule
         $page->changeTpl('lists/check.tpl');
 
         if (Post::has('correct')) {
+            S::assert_xsrf_token();
             $this->client->check_options($liste, true);
         }
 

diff --git a/templates/lists/admin.tpl b/templates/lists/admin.tpl
index 0adaf22..ff1276c 100644 (file)
--- a/templates/lists/admin.tpl
+++ b/templates/lists/admin.tpl
@@ -60,6 +60,7 @@ mails de marketing. Une fois inscrits à Polytechnique.org, l'inscription à la
 </script>
 
 <form method="post" action='{$smarty.server.REQUEST_URI}'>
+  {xsrf_token_field}
   <table class="bicol">
   {foreach from=$unregistered key=login item=it}
     <tr class="{cycle values="pair,impair"}">
@@ -103,6 +104,7 @@ mails de marketing. Une fois inscrits à Polytechnique.org, l'inscription à la
 </h1>
 
 <form method='post' action='{$smarty.server.REQUEST_URI}'>
+  {xsrf_token_field}
   <table class='tinybicol' cellpadding='0' cellspacing='0'>
     {foreach from=$owners item=xs key=promo}
     <tr>
@@ -140,6 +142,7 @@ mails de marketing. Une fois inscrits à Polytechnique.org, l'inscription à la
 </h1>
 
 <form method='post' action='{$smarty.server.REQUEST_URI}' enctype="multipart/form-data">
+  {xsrf_token_field}
   <table class='bicol' cellpadding='0' cellspacing='0'>
     {foreach from=$members item=xs key=promo}
     <tr>
@@ -155,7 +158,7 @@ mails de marketing. Une fois inscrits à Polytechnique.org, l'inscription à la
         {else}
         {$x.l}
         {/if}
-        <a href='{$platal->pl_self(1)}?del_member={$x.l}'>{icon name=cross title='retirer membre'}</a>
+        <a href='{$platal->pl_self(1)}?del_member={$x.l}&amp;token={xsrf_token}'>{icon name=cross title='retirer membre'}</a>
         <br />
         {/foreach}
       </td>

diff --git a/templates/lists/annu.tpl b/templates/lists/annu.tpl
index e03022c..1390e1f 100644 (file)
--- a/templates/lists/annu.tpl
+++ b/templates/lists/annu.tpl
@@ -54,13 +54,13 @@
       {if $details.sub>1}
       Tu es inscrit sur la liste.<br />
       Te désinscrire&nbsp;:
-      <a href='{$platal->pl_self(1)}?del=1'>{icon name=cross title="me désinscrire"}</a>
+      <a href='{$platal->pl_self(1)}?del=1&amp;token={xsrf_token}'>{icon name=cross title="me désinscrire"}</a>
       {elseif $details.sub eq 1}
       Ta demande d'inscription est en cours de validation.
       {else}
       Tu n'es pas inscrit.<br />
       Demander ton inscription&nbsp;:
-      <a href="{$platal->pl_self(1)}?add=1">{icon name=add title="demander mon inscription"}</a>
+      <a href="{$platal->pl_self(1)}?add=1&amp;token={xsrf_token}">{icon name=add title="demander mon inscription"}</a>
       {/if}
     </td>
   </tr>

diff --git a/templates/lists/check.tpl b/templates/lists/check.tpl
index 609b2f8..522fdee 100644 (file)
--- a/templates/lists/check.tpl
+++ b/templates/lists/check.tpl
@@ -36,6 +36,7 @@
   {/foreach}
 </table>
 <form action='{$platal->pl_self(1)}' method='post'>
+  {xsrf_token_field}
   <div class='center'>
     <br />
     <input type='submit' name='correct' value='Corriger les valeurs !' />

diff --git a/templates/lists/create.tpl b/templates/lists/create.tpl
index d642394..81437b7 100644 (file)
--- a/templates/lists/create.tpl
+++ b/templates/lists/create.tpl
@@ -38,6 +38,7 @@ liste :
 </p>
 
 <form action='lists/create' method='post' enctype="multipart/form-data">
+  {xsrf_token_field}
   <table class='bicol' cellspacing='0' cellpadding='2'>
     <tr>
       <th colspan='5'>Caractéristiques de la liste</th>

diff --git a/templates/lists/delete.tpl b/templates/lists/delete.tpl
index 1796e7d..65c25d6 100644 (file)
--- a/templates/lists/delete.tpl
+++ b/templates/lists/delete.tpl
@@ -41,6 +41,7 @@ Tu n'es pas administrateur de la liste, mais du site.
 </h1>
 
 <form method='post' action='{$platal->pl_self(1)}'>
+  {xsrf_token_field}
   <table class='tinybicol' cellpadding='2' cellspacing='0'>
     <tr class='impair'>
       <td>

diff --git a/templates/lists/index.tpl b/templates/lists/index.tpl
index 731a570..bd00c1e 100644 (file)
--- a/templates/lists/index.tpl
+++ b/templates/lists/index.tpl
@@ -93,6 +93,7 @@ Les listes de diffusion publiques sont visibles par tous les X inscrits à Polyt
 {/if}
 
 <form method='post' action='lists'>
+  {xsrf_token_field}
   <table class='tinybicol' cellspacing='0' cellpadding='2'>
     <tr>
       <th colspan='2'>Inscription à une liste de diffusion promo</th>

diff --git a/templates/lists/liste.inc.tpl b/templates/lists/liste.inc.tpl
index a6ae99e..2ebb469 100644 (file)
--- a/templates/lists/liste.inc.tpl
+++ b/templates/lists/liste.inc.tpl
@@ -37,8 +37,8 @@
   {if $liste.subscriptions|@count}
   <strong>&bull; Demandes d'inscription</strong><br />
   {foreach from=$liste.subscriptions item=s}
-    <a href='{$platal->ns}lists/moderate/{$liste.list}?sadd={$s.id}'
-        onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?sadd={$s.id}'));">
+    <a href='{$platal->ns}lists/moderate/{$liste.list}?sadd={$s.id}&amp;token={xsrf_token}'
+        onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?sadd={$s.id}&amp;token={xsrf_token}'));">
       {icon name=add title="Accepter"}
     </a>
     <a href='{$platal->ns}lists/moderate/{$liste.list}?sid={$s.id}'>
@@ -55,12 +55,12 @@
   <strong>&bull; Demandes de modération</strong><br />
   <span class="smaller">
   {foreach from=$liste.mails item=m}
-    <a href='{$platal->ns}lists/moderate/{$liste.list}?mid={$m.id}&amp;mok=1'
-        onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?mid={$m.id}&amp;mok=1'));">
+    <a href='{$platal->ns}lists/moderate/{$liste.list}?mid={$m.id}&amp;mok=1&amp;token={xsrf_token}'
+        onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?mid={$m.id}&amp;mok=1&amp;token={xsrf_token}'));">
       {icon name=add title="Valider le mail"}
     </a>
-    <a href='{$platal->ns}lists/moderate/{$liste.list}?mid={$m.id}&amp;mdel=1'
-        onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?mid={$m.id}&amp;mdel=1'));">
+    <a href='{$platal->ns}lists/moderate/{$liste.list}?mid={$m.id}&amp;mdel=1&amp;token={xsrf_token}'
+        onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?mid={$m.id}&amp;mdel=1&amp;token={xsrf_token}'));">
       {icon name=delete title="Spam"}
     </a>
     De&nbsp;: {$m.sender}<br />
@@ -81,15 +81,15 @@
 <td class='right'>{$liste.nbsub}</td>
 <td class='right'>
   {if $liste.sub eq 2}
-  <a href='{$platal->ns}lists?del={$liste.list}'
-      onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?unsubscribe=1'));">
+  <a href='{$platal->ns}lists?del={$liste.list}&amp;token={xsrf_token}'
+      onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?unsubscribe=1&amp;token={xsrf_token}'));">
     {icon name=cross title="me désinscrire"}
   </a>
   {elseif $liste.sub eq 1}
   {icon name=flag_orange title='inscription en attente de modération'}
   {else}
-  <a href='{$platal->ns}lists?add={$liste.list}'
-      onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?subscribe=1'));">
+  <a href='{$platal->ns}lists?add={$liste.list}&amp;token={xsrf_token}'
+      onclick="return (is_IE || Ajax.update_html('list_{$liste.list}', '{$platal->ns}lists/ajax/{$liste.list}?subscribe=1&amp;token={xsrf_token}'));">
     {icon name=add title="m'inscrire"}
   </a>
   {/if}

diff --git a/templates/lists/members.tpl b/templates/lists/members.tpl
index 135b6b8..b75548a 100644 (file)
--- a/templates/lists/members.tpl
+++ b/templates/lists/members.tpl
@@ -58,13 +58,13 @@
       {if $details.sub>1}
       Tu es inscrit sur la liste.<br />
       Te désinscrire&nbsp;:
-      <a href='{$platal->pl_self(1)}?del=1'>{icon name=cross title="me désinscrire"}</a>
+      <a href='{$platal->pl_self(1)}?del=1&amp;token={xsrf_token}'>{icon name=cross title="me désinscrire"}</a>
       {elseif $details.sub eq 1}
       Ta demande d'inscription est en cours de validation.
       {else}
       Tu n'es pas inscrit.<br />
       Demander ton inscription&nbsp;:
-      <a href="{$platal->pl_self(1)}?add=1">{icon name=add title="demander mon inscription"}</a>
+      <a href="{$platal->pl_self(1)}?add=1&amp;token={xsrf_token}">{icon name=add title="demander mon inscription"}</a>
       {/if}
     </td>
   </tr>

diff --git a/templates/lists/moderate.tpl b/templates/lists/moderate.tpl
index 7bd86d0..704c34f 100644 (file)
--- a/templates/lists/moderate.tpl
+++ b/templates/lists/moderate.tpl
@@ -42,7 +42,7 @@
     </td>
     <td>{$s.addr}</td>
     <td class='action'>
-      <a href='{$platal->pl_self(1)}?sadd={$s.id}'>{icon name=add title="Valider l'inscription"}</a>
+      <a href='{$platal->pl_self(1)}?sadd={$s.id}&amp;token={xsrf_token}'>{icon name=add title="Valider l'inscription"}</a>
       <a href='{$platal->pl_self(1)}?sid={$s.id}'>{icon name=delete title="Refuser l'inscription"}</a>
     </td>
   </tr>
@@ -93,6 +93,7 @@ function toggleAll() {
 //]]></script>
 
 <form method="post" action="{$platal->pl_self(1)}">
+{xsrf_token_field}
 {if $with_fromx}
 <table class="bicol" style="margin-bottom: 1ex">
   <tr>
@@ -125,11 +126,11 @@ function toggleAll() {
       {$m.size} octets</small>
     </td>
     <td class='action'>
-      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mok=1'>{icon name=add title="Accepter le message"}</a>
+      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mok=1&amp;token={xsrf_token}'>{icon name=add title="Accepter le message"}</a>
     </td>
     <td class='action'>
       <a href='{$platal->pl_self(1)}?mid={$m.id}'>{icon name=magnifier title="Voir le message"}</a><br/>
-      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mdel=1'>{icon name=delete title="Spam !"}</a>
+      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mdel=1&amp;token={xsrf_token}'>{icon name=delete title="Spam !"}</a>
     </td>
   </tr>
   {/if}
@@ -167,11 +168,11 @@ function toggleAll() {
       {$m.size} octets</small>
     </td>
     <td class='action'>
-      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mok=1'>{icon name=add title="Accepter le message"}</a>
+      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mok=1&amp;token={xsrf_token}'>{icon name=add title="Accepter le message"}</a>
     </td>
     <td class='action'>
       <a href='{$platal->pl_self(1)}?mid={$m.id}'>{icon name=magnifier title="Voir le message"}</a><br/>
-      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mdel=1'>{icon name=delete title="Spam !"}</a>
+      <a href='{$platal->pl_self(1)}?mid={$m.id}&amp;mdel=1&amp;token={xsrf_token}'>{icon name=delete title="Spam !"}</a>
     </td>
   </tr>
   {/if}

diff --git a/templates/lists/moderate_sub.tpl b/templates/lists/moderate_sub.tpl
index f0a6c85..b1066cc 100644 (file)
--- a/templates/lists/moderate_sub.tpl
+++ b/templates/lists/moderate_sub.tpl
@@ -23,6 +23,7 @@
 <h1>Refuser l'inscription d'un utilisateur</h1>
 
 <form method='post' action='{$platal->pl_self(1)}'>
+  {xsrf_token_field}
   <table class='tinybicol' cellpadding='0' cellspacing='0'>
     <tr>
       <th class='titre'>refuser l'inscription de&nbsp;:</th>

diff --git a/templates/lists/options.tpl b/templates/lists/options.tpl
index e329b6f..9dd310f 100644 (file)
--- a/templates/lists/options.tpl
+++ b/templates/lists/options.tpl
@@ -34,6 +34,7 @@ Tu n'es pas administrateur de la liste, mais du site.
 </h1>
 
 <form method='post' action='{$platal->pl_self(1)}'>
+  {xsrf_token_field}
   <table class='bicol' cellpadding='2' cellspacing='0'>
     <tr><th colspan='2'>Options de la liste {$details.addr}</th></tr>
     <tr class='impair'>
@@ -195,13 +196,14 @@ redirection en mode 'inactif'. le logiciel de mailing list saura se débrouiller
 </p>
 
 <form method='post' action='{$platal->pl_self(1)}'>
+  {xsrf_token_field}
   <table class='tinybicol' cellpadding='2' cellspacing='0'>
     <tr><th>Adresses non modérées</th></tr>
     <tr>
       <td>
         {if $options.accept_these_nonmembers|@count}
         {foreach from=$options.accept_these_nonmembers item=addr}
-        {$addr}<a href='{$platal->pl_self(1)}&amp;atn_del={$addr}'>
+        {$addr}<a href='{$platal->pl_self(1)}&amp;atn_del={$addr}&amp;token={xsrf_token}'>
           {icon name=cross title="retirer de la whitelist"}
         </a><br />
         {/foreach}

diff --git a/templates/lists/soptions.tpl b/templates/lists/soptions.tpl
index b2a3d1b..f2896af 100644 (file)
--- a/templates/lists/soptions.tpl
+++ b/templates/lists/soptions.tpl
@@ -28,6 +28,7 @@
 </h1>
 
 <form method='post' action='{$platal->pl_self(1)}'>
+  {xsrf_token_field}
   <table class='bicol' cellpadding='2' cellspacing='0'>
     <tr><th colspan='2'>Options de la liste {$details.addr}</th></tr>
     <tr class='impair'>