Skip to:
Content

bbPress.org

Changeset 1396


Ignore:
Timestamp:
04/01/2008 08:24:36 AM (18 years ago)
Author:
mdawaffe
Message:

bb_check_ajax_referer() should check nonce, not cookies. Hack JS to make it happen for branches/0.8

Location:
branches/0.8
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • branches/0.8/bb-admin/admin-ajax.php

    r1221 r1396  
    22require_once('../bb-load.php');
    33require_once(BB_PATH . 'bb-admin/admin-functions.php');
    4 bb_check_ajax_referer();
    54
    65if ( !$bb_current_id = bb_get_current_user_info( 'id' ) )
    … …  
    1716}
    1817
    19 switch ( $_POST['action'] ) :
    20 case 'add-tag' :
     18$id = (int) @$_POST['id'];
     19
     20switch ( $action = $_POST['action'] ) :
     21case 'add-tag' : // $id is topic_id
     22    if ( !bb_current_user_can('edit_tag_by_on', $bb_current_id, $id) )
     23        die('-1');
     24
     25    bb_check_ajax_referer( "add-tag_$id" );
     26
    2127    global $tag, $topic;
    2228    add_action('bb_tag_added', 'bb_grab_results', 10, 3);
    2329    add_action('bb_already_tagged', 'bb_grab_results', 10, 3);
    24     $topic_id = (int) @$_POST['id'];
    25     $tag_name =       @$_POST['tag'];
     30    $tag_name = @$_POST['tag'];
    2631    $tag_name = stripslashes( $tag_name );
    27     if ( !bb_current_user_can('edit_tag_by_on', $bb_current_id, $topic_id) )
    28         die('-1');
    29 
    30     $topic = get_topic( $topic_id );
     32
     33    $topic = get_topic( $id );
    3134    if ( !$topic )
    3235        die('0');
    … …  
    3437    $tag_name = rawurldecode($tag_name);
    3538    $x = new WP_Ajax_Response();
    36     foreach ( bb_add_topic_tags( $topic_id, $tag_name ) as $tag_id ) {
     39    foreach ( bb_add_topic_tags( $id, $tag_name ) as $tag_id ) {
    3740        if ( !is_numeric($tag_id) || !$tag = bb_get_tag( $tag_id, bb_get_current_user_info( 'id' ), $topic->topic_id ) )
    3841            if ( !$tag = bb_get_tag( $tag_id ) )
    … …  
    5053
    5154case 'delete-tag' :
    52     add_action('bb_rpe_tag_removed', 'bb_grab_results', 10, 3);
    5355    list($tag_id, $user_id) = explode('_', $_POST['id']);
    5456    $tag_id   = (int) $tag_id;
    … …  
    5961        die('-1');
    6062
     63    bb_check_ajax_referer( "remove-tag_$tag_id|$topic_id" );
     64
     65    add_action('bb_rpe_tag_removed', 'bb_grab_results', 10, 3);
     66
    6167    $tag   = bb_get_tag( $tag_id );
    6268    $user  = bb_get_user( $user_id );
    … …  
    8086        die('-1');
    8187
     88    bb_check_ajax_referer( "toggle-favorite_$topic_id" );
     89
    8290    $is_fav = is_user_favorite( $user_id, $topic_id );
    8391
    … …  
    8593        if ( bb_remove_user_favorite( $user_id, $topic_id ) )
    8694            die('1');
    87     } elseif ( 0 === $is_fav ) {
     95    } elseif ( false === $is_fav ) {
    8896        if ( bb_add_user_favorite( $user_id, $topic_id ) )
    8997            die('1');
    … …  
    9199    break;
    92100
    93 case 'delete-post' :
    94     $post_id = (int) $_POST['id'];
     101case 'delete-post' : // $id is post_id
     102    if ( !bb_current_user_can( 'delete_post', $id ) )
     103        die('-1');
     104
     105    bb_check_ajax_referer( "delete-post_$id" );
     106
    95107    $page = (int) $_POST['page'];
    96108    $last_mod = (int) $_POST['last_mod'];
    97109
    98     if ( !bb_current_user_can( 'delete_post', $post_id ) )
    99         die('-1');
    100 
    101     $bb_post = bb_get_post ( $post_id );
     110    $bb_post = bb_get_post( $id );
    102111
    103112    if ( !$bb_post )
    … …  
    106115    $topic = get_topic( $bb_post->topic_id );
    107116
    108     if ( bb_delete_post( $post_id, 1 ) )
     117    if ( bb_delete_post( $id, 1 ) )
    109118        die('1');
    110119    break;
    111120/*
    112121case 'add-post' : // Can put last_modified stuff back in later
     122    bb_check_ajax_referer( $action );
    113123    $error = false;
    114124    $post_id = 0;
    … …  
    153163        die('-1');
    154164
     165    bb_check_ajax_referer( $action );
     166
    155167    if ( !$forum_id = bb_new_forum( $_POST ) )
    156168        die('0');
    … …  
    171183        die('-1');
    172184
     185    bb_check_ajax_referer( $action );
     186
    173187    if ( !is_array($_POST['order']) )
    174188        die('0');
    … …  
    198212default :
    199213    do_action( 'bb_ajax_' . $_POST['action'] );
    200     die('0');
    201214    break;
    202215endswitch;
     216
     217die('0');
    203218?>

  • branches/0.8/bb-admin/admin-functions.php

    r1386 r1396  
    581581        <input type="hidden" name="forum_id" value="<?php echo $forum_id; ?>" />
    582582<?php endif; ?>
     583        <?php bb_nonce_field( 'order-forums', 'order-nonce' ); ?>
    583584        <?php bb_nonce_field( "$action-forum" ); ?>
    584 
    585585        <input type="hidden" name="action" value="<?php echo $action; ?>" />
    586586        <input name="Submit" type="submit" value="<?php if ( $forum_id ) _e('Update Forum &#187;'); else _e('Add Forum &#187;'); ?>" tabindex="13" />

  • branches/0.8/bb-admin/js/content-forums.js

    r1348 r1396  
    9595            $.post(
    9696                'admin-ajax.php',
    97                 'action=order-forums&cookie=' + encodeURIComponent(document.cookie) + '&' + hash
     97                'action=order-forums&_ajax_nonce=' +  $('#add-forum input[name=order-nonce]').val() + '&' + hash
    9898            );
    9999        } );

  • branches/0.8/bb-includes/js/topic-js.php

    r1216 r1396  
    66} );
    77
    8 function ajaxPostDelete(postId, postAuthor) {
     8function ajaxPostDelete(postId, postAuthor, a) {
    99    if (!confirm('<?php printf(__("Are you sure you wanna delete this post by \"' + %s + '\"?"), 'postAuthor'); //postAuthor should be left untranslated ?>')) return false;
     10    thePostList.inputData = '&_ajax_nonce=' + a.href.toQueryParams()['_wpnonce'];
    1011    return thePostList.ajaxDelete( 'post', postId );
    1112}
    … …  
    3738} );
    3839
    39 function ajaxDelTag(tag, user, tagName) {
     40function ajaxDelTag(tag, user, tagName, a) {
     41    yourTagList.inputData = '&topic_id=' + topicId + '&_ajax_nonce=' + a.href.toQueryParams()['_wpnonce'];
     42    othersTagList.inputData = '&topic_id=' + topicId + '&_ajax_nonce=' + a.href.toQueryParams()['_wpnonce'];
    4043    if ( !confirm('<?php printf(__("Are you sure you want to remove the \"' + %s + '\" tag?"), 'tagName'); ?>') )
    4144        return false;
    … …  
    4750
    4851addLoadEvent( function() { // TopicMeta
     52    var favoritesToggle = $('favorite-toggle');
     53    favoritesToggle[ 1 === isFav ? 'removeClass' : 'addClass' ]( 'is-not-favorite' );
    4954    theTopicMeta = new listMan('topicmeta');
    5055    theTopicMeta.showLink = false;
    51     theTopicMeta.inputData = '&user_id=' + currentUserId + '&topic_id=' + topicId;
     56    var nonce = jQuery( '#favorite-toggle a[href*="_wpnonce="]' ).click( FavIt ).attr( 'href' ).toQueryParams()['_wpnonce'];
     57    theTopicMeta.inputData = '&user_id=' + currentUserId + '&topic_id=' + topicId + '&_ajax_nonce=' + nonce;
    5258    theTopicMeta.dimComplete = function(what, id, dimClass) {
    5359        if ( 'is-not-favorite' == dimClass ) {
    54             var favoritesToggle = $('favorite-toggle');
    5560            isFav = favoritesToggle.hasClassName(dimClass) ? 0 : 1;
    5661            favLinkSetup();
    5762        }
    5863    }
    59     favLinkSetup();
    60            
    6164} );
    6265
    6366function favLinkSetup() {
    6467    var favoritesToggle = $('favorite-toggle');
    65     if ('no' == isFav)
    66         return;
    6768    if ( 1 == isFav )
    6869        favoritesToggle.update('<?php printf(__("This topic is one of your <a href=' + %s + '>favorites</a>"), 'favoritesLink'); ?> [<a href="#" onclick="return FavIt();">x</a>]');

  • branches/0.8/bb-includes/pluggable.php

    r1394 r1396  
    285285    $i = ceil(time() / 43200);
    286286
    287     //Allow for expanding range, but only do one check if we can
    288     if( substr(wp_hash($i . $action . $uid), -12, 10) == $nonce || substr(wp_hash(($i - 1) . $action . $uid), -12, 10) == $nonce )
    289         return true;
     287    // Nonce generated 0-12 hours ago
     288    if ( substr(wp_hash($i . $action . $uid), -12, 10) == $nonce )
     289        return 1;
     290    // Nonce generated 12-24 hours ago
     291    if ( substr(wp_hash(($i - 1) . $action . $uid), -12, 10) == $nonce )
     292        return 2;
     293    // Invalid nonce
    290294    return false;
    291295}
    … …  
    402406
    403407if ( !function_exists('bb_check_admin_referer') ) :
    404 function bb_check_admin_referer( $action = -1 ) {
    405     if ( !bb_verify_nonce($_REQUEST['_wpnonce'], $action) ) {
     408function bb_check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
     409    if ( !bb_verify_nonce($_REQUEST[$query_arg], $action) ) {
    406410        bb_nonce_ays($action);
    407411        die();
    … …  
    412416
    413417if ( !function_exists('bb_check_ajax_referer') ) :
    414 function bb_check_ajax_referer() {
    415     if ( !$current_id = bb_get_current_user_info( 'ID' ) )
     418function bb_check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
     419    if ( $query_arg )
     420        $nonce = $_REQUEST[$query_arg];
     421    else
     422        $nonce = $_REQUEST['_ajax_nonce'] ? $_REQUEST['_ajax_nonce'] : $_REQUEST['_wpnonce'];
     423
     424    $result = bb_verify_nonce( $nonce, $action );
     425
     426    if ( $die && false == $result )
    416427        die('-1');
    417    
    418     $cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie
    419     foreach ( $cookie as $tasty ) {
    420         if ( false !== strpos($tasty, bb_get_option( 'authcookie' )) )
    421             $auth_cookie = substr(strstr($tasty, '='), 1);
    422     }
    423    
    424     if ( empty($auth_cookie) )
    425         die('-1');
    426    
    427     if ( ! $user_id = wp_validate_auth_cookie( $auth_cookie ) )
    428         die('-1');
    429    
    430     if ( $current_id != $user_id )
    431         die('-1');
    432    
    433     do_action('bb_check_ajax_referer');
     428
     429    do_action('bb_check_ajax_referer', $action, $result);
     430    return $result;
    434431}
    435432endif;

  • branches/0.8/bb-includes/script-loader.php

    r1348 r1396  
    1515        $this->add( 'wp-ajax', '/' . BB_INC . 'js/wp-ajax-js.php', array('prototype'), '2.1-beta2' );
    1616        $this->add( 'listman', '/' . BB_INC . 'js/list-manipulation-js.php', array('add-load-event', 'wp-ajax', 'fat'), '440' );
    17         $this->add( 'topic', '/' . BB_INC . 'js/topic-js.php', array('add-load-event', 'listman'), '433' );
     17        $this->add( 'topic', '/' . BB_INC . 'js/topic-js.php', array('add-load-event', 'listman'), '20080401' );
    1818        $this->add( 'jquery', '/' . BB_INC . 'js/jquery/jquery.js', false, '1.1.3.1');
    1919        $this->add( 'interface', '/' . BB_INC . 'js/jquery/interface.js', array('jquery'), '1.2.3');
    … …  
    194194        return false;
    195195    }
    196            
    197196}
    198197

  • branches/0.8/bb-includes/template-functions.php

    r1386 r1396  
    12691269        $r = "<a href='" . attribute_escape( bb_nonce_url( bb_get_option('uri') . 'bb-admin/delete-post.php?id=' . $bb_post->post_id . '&status=0&view=all', 'delete-post_' . $bb_post->post_id ) ) . "' onclick='return confirm(\" ". js_escape( __('Are you sure you wanna undelete that?') ) ." \");'>". __('Undelete') ."</a>";
    12701270    else
    1271         $r = "<a href='" . attribute_escape( bb_nonce_url( bb_get_option('uri') . 'bb-admin/delete-post.php?id=' . $bb_post->post_id . '&status=1', 'delete-post_' . $bb_post->post_id ) ) . "' onclick='return ajaxPostDelete(" . $bb_post->post_id . ", \"" . get_post_author( $post_id ) . "\");'>". __('Delete') ."</a>";
     1271        $r = "<a href='" . attribute_escape( bb_nonce_url( bb_get_option('uri') . 'bb-admin/delete-post.php?id=' . $bb_post->post_id . '&status=1', 'delete-post_' . $bb_post->post_id ) ) . "' onclick='return ajaxPostDelete(" . $bb_post->post_id . ", \"" . get_post_author( $post_id ) . "\", this);'>". __('Delete') ."</a>";
    12721272    $r = apply_filters( 'post_delete_link', $r, $bb_post->post_status, $bb_post->post_id );
    12731273    echo $r;
    … …  
    18281828        return false;
    18291829    $url = add_query_arg( array('tag' => $tag->tag_id, 'user' => $tag->user_id, 'topic' => $tag->topic_id), bb_get_option('uri') . 'tag-remove.php' );
    1830     $r = '[<a href="' . attribute_escape( bb_nonce_url( $url, 'remove-tag_' . $tag->tag_id . '|' . $tag->topic_id) ) . '" onclick="return ajaxDelTag(' . $tag->tag_id . ', ' . $tag->user_id . ', \'' . js_escape($tag->raw_tag) . '\');" title="' . attribute_escape( __('Remove this tag') ) . '">&times;</a>]';
     1830    $r = '[<a href="' . attribute_escape( bb_nonce_url( $url, 'remove-tag_' . $tag->tag_id . '|' . $tag->topic_id) ) . '" onclick="return ajaxDelTag(' . $tag->tag_id . ', ' . $tag->user_id . ', \'' . js_escape($tag->raw_tag) . '\', this);" title="' . attribute_escape( __('Remove this tag') ) . '">&times;</a>]';
    18311831    return $r;
    18321832}
Note: See TracChangeset for help on using the changeset viewer.