lindeas
/
jilo-web
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases 5 Wiki Activity

Fixes CSRF

main
Yasen Pramatarov 2025-02-23 17:48:02 +02:00
parent a45e064c18
commit b4b5a7ac8f
2 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/includes/csrf_middleware.php
View File

@ -3,7 +3,6 @@
require_once __DIR__ . '/../helpers/security.php'; require_once __DIR__ . '/../helpers/security.php';
function applyCsrfMiddleware() { function applyCsrfMiddleware() {
global $dbWeb, $logObject;
$security = SecurityHelper::getInstance(); $security = SecurityHelper::getInstance();
// Skip CSRF check for GET requests // Skip CSRF check for GET requests
@ -11,9 +10,10 @@ function applyCsrfMiddleware() {
return true; return true;
} }
// Skip CSRF check for initial login attempt // Skip CSRF check for initial login and registration attempts
if ($_SERVER['REQUEST_METHOD'] === 'POST' && if ($_SERVER['REQUEST_METHOD'] === 'POST' &&
isset($_GET['page']) && $_GET['page'] === 'login' && isset($_GET['page']) &&
in_array($_GET['page'], ['login', 'register']) &&
!isset($_SESSION['username'])) { !isset($_SESSION['username'])) {
return true; return true;
} }
@ -29,7 +29,7 @@ function applyCsrfMiddleware() {
$_GET['page'] ?? 'unknown', $_GET['page'] ?? 'unknown',
$_SESSION['username'] ?? 'anonymous' $_SESSION['username'] ?? 'anonymous'
); );
$logObject->insertLog(0, $logMessage); $logObject->insertLog(0, $logMessage, 'system');
// Return error message // Return error message
http_response_code(403); http_response_code(403);

16
public_html/index.php
View File

@ -24,14 +24,6 @@ require '../app/includes/sanitize.php';
session_name('jilo'); session_name('jilo');
session_start(); session_start();
// Initialize security middleware
require_once '../app/includes/csrf_middleware.php';
require_once '../app/helpers/security.php';
$security = SecurityHelper::getInstance();
// Verify CSRF token for POST requests
applyCsrfMiddleware();
// Initialize feedback message system // Initialize feedback message system
require_once '../app/classes/feedback.php'; require_once '../app/classes/feedback.php';
$system_messages = []; $system_messages = [];
@ -137,6 +129,14 @@ include '../app/helpers/logs.php';
$logObject = new Log($dbWeb); $logObject = new Log($dbWeb);
$user_IP = getUserIP(); $user_IP = getUserIP();
// Initialize security middleware
require_once '../app/includes/csrf_middleware.php';
require_once '../app/helpers/security.php';
$security = SecurityHelper::getInstance();
// Verify CSRF token for POST requests
applyCsrfMiddleware();
// init rate limiter // init rate limiter
require '../app/classes/ratelimiter.php'; require '../app/classes/ratelimiter.php';