From e7fdf9dd16c4a3bcbd4936d4726ef3080537812c Mon Sep 17 00:00:00 2001
From: Vincent Zanotti <vincent.zanotti@polytechnique.org>
Date: Mon, 30 Jun 2008 01:43:24 +0200
Subject: [PATCH] Adds XSRF protection to the XnetGrp module.

Signed-off-by: Vincent Zanotti <vincent.zanotti@polytechnique.org>
---
 modules/xnetgrp.php                  | 26 ++++++++++++++++++++------
 templates/xnetgrp/announce-admin.tpl |  2 +-
 templates/xnetgrp/announce-edit.tpl  |  1 +
 templates/xnetgrp/inscrire.tpl       |  2 ++
 templates/xnetgrp/mail.tpl           |  1 +
 templates/xnetgrp/membres-add.tpl    |  1 +
 templates/xnetgrp/membres-del.tpl    |  1 +
 templates/xnetgrp/membres-edit.tpl   |  1 +
 8 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/modules/xnetgrp.php b/modules/xnetgrp.php
index a9a9815..682b88f 100644
--- a/modules/xnetgrp.php
+++ b/modules/xnetgrp.php
@@ -312,6 +312,7 @@ class XnetGrpModule extends PLModule
         $page->addJsLink('ajax.js');
 
         if (Post::has('send')) {
+            S::assert_xsrf_token();
             $from  = Post::v('from');
             $sujet = Post::v('sujet');
             $body  = Post::v('body');
@@ -571,14 +572,14 @@ class XnetGrpModule extends PLModule
                     $this->removeSubscriptionRequest($uid);
                     $page->kill("$prenom $nom est déjà membre du groupe !");
                     return;
-                }
-                elseif (Env::has('accept'))
-                {
+                } elseif (Env::has('accept')) {
+                    S::assert_xsrf_token();
+
                     $this->validSubscription($nom, $prenom, $sexe, $uid, $u);
                     pl_redirect("member/$u");
-                }
-                elseif (Env::has('refuse'))
-                {
+                } elseif (Env::has('refuse')) {
+                    S::assert_xsrf_token();
+
                     $this->removeSubscriptionRequest($uid);
                     $mailer = new PlMailer();
                     $mailer->addTo("$u@polytechnique.org");
@@ -616,6 +617,8 @@ class XnetGrpModule extends PLModule
         }
 
         if (Post::has('inscrire')) {
+            S::assert_xsrf_token();
+
             XDB::execute("INSERT INTO  groupex.membres_sub_requests (asso_id, uid, ts, reason)
                                VALUES  ({?}, {?}, NOW(), {?})",
                          $globals->asso('id'), S::i('uid'), Post::v('message'));
@@ -782,6 +785,8 @@ class XnetGrpModule extends PLModule
 
         if (is_null($email)) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         if (strpos($email, '@') === false) {
@@ -950,6 +955,8 @@ class XnetGrpModule extends PLModule
 
         if (!Post::has('confirm')) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         if ($this->unsubscribe($user)) {
@@ -971,6 +978,8 @@ class XnetGrpModule extends PLModule
 
         if (!Post::has('confirm')) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         if ($this->unsubscribe($user)) {
@@ -1064,6 +1073,8 @@ class XnetGrpModule extends PLModule
                              $globals->asso('mail_domain'));
 
         if (Post::has('change')) {
+            S::assert_xsrf_token();
+
             // Convert user status to X
             if ($user['origine'] == 'ext' && trim(Post::v('login_X'))) {
                 $forlife = $this->changeLogin($page, $user, $mmlist, trim(Post::v('login_X')));
@@ -1248,6 +1259,8 @@ class XnetGrpModule extends PLModule
 
         if (Post::v('valid') == 'Visualiser' || Post::v('valid') == 'Enregistrer'
             || Post::v('valid') == 'Supprimer l\'image' || Post::v('valid') == 'Pas d\'image') {
+            S::assert_xsrf_token();
+
             if (!is_null($aid)) {
                 $art['id'] = $aid;
             }
@@ -1411,6 +1424,7 @@ class XnetGrpModule extends PLModule
         $page->changeTpl('xnetgrp/announce-admin.tpl');
 
         if (Env::has('del')) {
+            S::assert_xsrf_token();
             XDB::execute("DELETE  FROM groupex.announces
                            WHERE  id = {?} AND asso_id = {?}",
                          Env::i('del'), $globals->asso('id'));
diff --git a/templates/xnetgrp/announce-admin.tpl b/templates/xnetgrp/announce-admin.tpl
index 1e4ee15..470b09d 100644
--- a/templates/xnetgrp/announce-admin.tpl
+++ b/templates/xnetgrp/announce-admin.tpl
@@ -32,7 +32,7 @@
   <tr class="{if $art.perime}im{/if}pair">
     <td><a href="{$platal->ns}announce/edit/{$art.id}">{$art.titre}</a></td>
     <td>{$art.peremption|date_format}</td>
-    <td class="right"><a href="{$platal->ns}admin/announces?del={$art.id}">
+    <td class="right"><a href="{$platal->ns}admin/announces?del={$art.id}&amp;token={xsrf_token}">
         Supprimer l'annonce {icon name=cross}
       </a>
     </td>
diff --git a/templates/xnetgrp/announce-edit.tpl b/templates/xnetgrp/announce-edit.tpl
index 6337ea4..413fd12 100644
--- a/templates/xnetgrp/announce-edit.tpl
+++ b/templates/xnetgrp/announce-edit.tpl
@@ -42,6 +42,7 @@ function visibilityChange(box)
 {/if}
 
 <form method="post" action="{$platal->ns}announce/{if $new}new{else}edit/{$art.id}{/if}" enctype="multipart/form-data">
+{xsrf_token_field}
 <div>
   <table class="bicol">
     <tr>
diff --git a/templates/xnetgrp/inscrire.tpl b/templates/xnetgrp/inscrire.tpl
index 0d0787d..edf1b49 100644
--- a/templates/xnetgrp/inscrire.tpl
+++ b/templates/xnetgrp/inscrire.tpl
@@ -36,6 +36,7 @@
 {/if}
 
 <form action="{$platal->ns}subscribe/{$u}" method="post">
+  {xsrf_token_field}
   <table class="bicol">
     <tr>
       <td>Raison (en cas de refus)&nbsp;:</td>
@@ -71,6 +72,7 @@ formulaire ci-dessous. Vérifie et corrige au besoin les différents champs, pui
 [&nbsp;M'inscrire&nbsp;!&nbsp;].
 </p>
 <form action="{$platal->ns}subscribe" method="post">
+  {xsrf_token_field}
   <p class="descr">
   <strong>OUI, je souhaite être inscrit au groupe {$asso.nom}.</strong>
   </p>
diff --git a/templates/xnetgrp/mail.tpl b/templates/xnetgrp/mail.tpl
index 88d4a3e..3880d24 100644
--- a/templates/xnetgrp/mail.tpl
+++ b/templates/xnetgrp/mail.tpl
@@ -43,6 +43,7 @@ masculin ou féminin, par son prénom, ou son nom.
 //]]></script>
  
 <form action="{$platal->ns}mail" method="post" enctype="multipart/form-data">
+  {xsrf_token_field}
   <table class='bicol'>
     <tr>
       <th colspan="2">Écrire un mail&nbsp;:</th>
diff --git a/templates/xnetgrp/membres-add.tpl b/templates/xnetgrp/membres-add.tpl
index 7b674d2..40b4dda 100644
--- a/templates/xnetgrp/membres-add.tpl
+++ b/templates/xnetgrp/membres-add.tpl
@@ -55,6 +55,7 @@ function searchX()
 <h1>{$asso.nom}&nbsp;: Ajout d'un membre</h1>
 
 <form method="post" action="{$platal->ns}member/new/">
+  {xsrf_token_field}
   <ul class='descr'>
     <li>
       Pour ajouter un X dans ton groupe, il suffit d'entrer ici une de ses
diff --git a/templates/xnetgrp/membres-del.tpl b/templates/xnetgrp/membres-del.tpl
index ad51b2e..cec88a5 100644
--- a/templates/xnetgrp/membres-del.tpl
+++ b/templates/xnetgrp/membres-del.tpl
@@ -40,6 +40,7 @@
 
 
 <form method="post" action="{$platal->pl_self()}">
+  {xsrf_token_field}
   <div class="center">
     <p class="descr">
     {if $self}
diff --git a/templates/xnetgrp/membres-edit.tpl b/templates/xnetgrp/membres-edit.tpl
index 76c8045..f30c160 100644
--- a/templates/xnetgrp/membres-edit.tpl
+++ b/templates/xnetgrp/membres-edit.tpl
@@ -57,6 +57,7 @@
 </h2>
 
 <form method="post" action="{$platal->ns}member/{$platal->argv[1]}">
+  {xsrf_token_field}
   <table cellpadding="0" cellspacing="0" class='tinybicol'>
     <tr class="pair">
       <td class="titre">
-- 
2.1.4