From 74b5e22a684c3095dbd48b56da1a10d955c20305 Mon Sep 17 00:00:00 2001
From: Frank Karlitschek <karlitschek@kde.org>
Date: Thu, 26 Apr 2012 23:17:46 +0200
Subject: [PATCH 1/2] some more csrf fixes

---
 core/templates/login.php |  1 +
 index.php                | 14 +++++++-------
 lib/util.php             |  3 +++
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/core/templates/login.php b/core/templates/login.php
index 4ba92221a7d..4035dfe8a5a 100644
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -12,6 +12,7 @@
 		<p class="infield">
 			<label for="password" class="infield"><?php echo $l->t( 'Password' ); ?></label>
 			<input type="password" name="password" id="password" value="" required <?php echo !empty($_POST['user'])?'autofocus':''; ?> />
+			<input type="hidden" name="sectoken" id="sectoken" value="<?php echo($_['sectoken']); ?>"  />
 		</p>
 		<input type="checkbox" name="remember_login" value="1" id="remember_login" /><label for="remember_login"><?php echo $l->t('remember'); ?></label>
 		<input type="submit" id="submit" class="login" value="<?php echo $l->t( 'Log in' ); ?>" />
diff --git a/index.php b/index.php
index b4cac1879c6..9fff459807e 100644
--- a/index.php
+++ b/index.php
@@ -59,10 +59,9 @@ elseif(OC_User::isLoggedIn()) {
 	else {
 		OC_Util::redirectToDefaultPage();
 	}
-}
 
 // For all others cases, we display the guest page :
-else {
+} else {
 	OC_App::loadApps();
 	$error = false;
 
@@ -80,10 +79,9 @@ else {
 		else {
 			OC_User::unsetMagicInCookie();
 		}
-	}
 
 	// Someone wants to log in :
-	elseif(isset($_POST["user"]) && isset($_POST['password'])) {
+	} elseif(isset($_POST["user"]) and isset($_POST['password']) and isset($_SESSION['sectoken']) and isset($_POST['sectoken']) and ($_SESSION['sectoken']==$_POST['sectoken']) ) {
 		if(OC_User::login($_POST["user"], $_POST["password"])) {
 			if(!empty($_POST["remember_login"])){
 				if(defined("DEBUG") && DEBUG) {
@@ -100,9 +98,9 @@ else {
 		} else {
 			$error = true;
 		}
-	}
+	
 	// The user is already authenticated using Apaches AuthType Basic... very usable in combination with LDAP
-	elseif(isset($_SERVER["PHP_AUTH_USER"]) && isset($_SERVER["PHP_AUTH_PW"])){
+	} elseif(isset($_SERVER["PHP_AUTH_USER"]) && isset($_SERVER["PHP_AUTH_PW"])){
 		if (OC_User::login($_SERVER["PHP_AUTH_USER"],$_SERVER["PHP_AUTH_PW"]))	{
 			//OC_Log::write('core',"Logged in with HTTP Authentication",OC_Log::DEBUG);
 			OC_User::unsetMagicInCookie();
@@ -111,5 +109,7 @@ else {
 			$error = true;
 		}
 	}
-	OC_Template::printGuestPage('', 'login', array('error' => $error, 'redirect' => isset($_REQUEST['redirect_url'])?$_REQUEST['redirect_url']:'' ));
+	$sectoken=rand(1000000,9999999);
+	$_SESSION['sectoken']=$sectoken;
+	OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => isset($_REQUEST['redirect_url'])?$_REQUEST['redirect_url']:'' ));
 }
diff --git a/lib/util.php b/lib/util.php
index ec70fd91cb5..29d0691a63d 100644
--- a/lib/util.php
+++ b/lib/util.php
@@ -253,6 +253,9 @@ class OC_Util {
 		} else {
 			$parameters["username"] = '';
 		}
+		$sectoken=rand(1000000,9999999);
+		$_SESSION['sectoken']=$sectoken;
+		$parameters["sectoken"] = $sectoken;
 		OC_Template::printGuestPage("", "login", $parameters);
 	}
 

From ee0cb68f5ed91f30b5ab4c43d13433197b4fcb24 Mon Sep 17 00:00:00 2001
From: Frank Karlitschek <karlitschek@kde.org>
Date: Fri, 27 Apr 2012 01:18:21 +0200
Subject: [PATCH 2/2] some csrf fixes. needs testing

---
 lib/base.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/base.php b/lib/base.php
index 5c42000b9e1..a30f4e38c78 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -325,6 +325,16 @@ class OC{
 		self::checkInstalled();
 		self::checkSSL();
 
+                // CSRF protection
+                if(isset($_SERVER['HTTP_REFERER'])) $referer=$_SERVER['HTTP_REFERER']; else $referer='';
+                if(isset($_SERVER['HTTPS']) and $_SERVER['HTTPS']<>'') $protocol='https://'; else $protocol='http://';
+                $server=$protocol.$_SERVER['SERVER_NAME'];
+                if(($_SERVER['REQUEST_METHOD']=='POST') and (substr($referer,0,strlen($server))<>$server)) {
+                        $url = $protocol.$_SERVER['SERVER_NAME'].OC::$WEBROOT.'/index.php';
+                        header("Location: $url");
+                        exit();
+                } 
+
 		self::initSession();
 		self::initTemplateEngine();
 		self::checkUpgrade();