Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-base: protect CBI forms with CSRF tokens

Browse source 
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This commit is contained in:
Jo-Philipp Wich 2015-10-06 18:54:35 +02:00
parent 5a6382171d
commit 8d46c20327
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
modules/luci-base/luasrc/dispatcher.lua
View file

@ -743,6 +743,15 @@ local function _cbi(self, ...)
local cbi = require "luci.cbi" local cbi = require "luci.cbi"
local tpl = require "luci.template" local tpl = require "luci.template"
local http = require "luci.http" local http = require "luci.http"
local disp = require "luci.dispatcher"
if http.formvalue("cbi.submit") == "1" and
http.formvalue("token") ~= disp.context.urltoken.stok
then
http.status(403, "Forbidden")
luci.template.render("csrftoken")
return
end
local config = self.config or {} local config = self.config or {}
local maps = cbi.load(self.model, ...) local maps = cbi.load(self.model, ...)

1
modules/luci-base/luasrc/view/cbi/header.htm
View file

@ -2,6 +2,7 @@
<form method="post" name="cbi" action="<%=REQUEST_URI%>" enctype="multipart/form-data" onreset="return cbi_validate_reset(this)" onsubmit="return cbi_validate_form(this, '<%:Some fields are invalid, cannot save values!%>')"> <form method="post" name="cbi" action="<%=REQUEST_URI%>" enctype="multipart/form-data" onreset="return cbi_validate_reset(this)" onsubmit="return cbi_validate_form(this, '<%:Some fields are invalid, cannot save values!%>')">
<div> <div>
<script type="text/javascript" src="<%=resource%>/cbi.js"></script> <script type="text/javascript" src="<%=resource%>/cbi.js"></script>
<input type="hidden" name="token" value="<%=token%>" />
<input type="hidden" name="cbi.submit" value="1" /> <input type="hidden" name="cbi.submit" value="1" />
<input type="submit" value="<%:Save%>" class="hidden" /> <input type="submit" value="<%:Save%>" class="hidden" />
</div> </div>