[aur-dev] [PATCH 1/2] pkg_details: Convert most action links to forms
Use forms and POST instead of GET for following actions: * Flagging/Unflagging a package out-of-date * Voting for a package and removing votes * Enabling/Disabling notifications Use CSS to make the submit buttons of these forms look like links. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> --- web/html/css/aur.css | 19 +++++++++++++++++++ web/template/pkg_details.php | 36 ++++++++++++++++++++++++++++++------ 2 files changed, 49 insertions(+), 6 deletions(-) diff --git a/web/html/css/aur.css b/web/html/css/aur.css index bae8e21..a8fb009 100644 --- a/web/html/css/aur.css +++ b/web/html/css/aur.css @@ -14,3 +14,22 @@ #pkg-stats td.stat-desc { white-space: normal; } + +#actionlist form { + margin: 0; + padding: 0; +} + +#actionlist .text-button { + color: #07b; + background: none; + border: none; + padding: 0; + cursor: pointer; + font-size: 100%; +} + +#actionlist .text-button:hover { + text-decoration: underline; + color: #666; +} diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 0973448..bd54923 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -39,20 +39,44 @@ $sources = package_sources($row["ID"]); <li><span class="flagged"><?php if ($row["OutOfDateTS"] !== NULL) { echo __('Flagged out-of-date')." (${out_of_date_time})"; } ?></span></li> <?php if ($USE_VIRTUAL_URLS && $uid): ?> <?php if ($row["OutOfDateTS"] === NULL): ?> - <li><a href="<?= get_pkg_uri($row['Name']) . 'flag/'; ?>"><?= __('Flag package out-of-date'); ?></a></li> + <li> + <form action="<?= get_pkg_uri($row['Name']) . 'flag/'; ?>" method="post"> + <input type="submit" class="button text-button" name="do_Flag" value="<?= __('Flag package out-of-date') ?>" /> + </form> + </li> <?php elseif (($row["OutOfDateTS"] !== NULL) && ($uid == $row["MaintainerUID"] || $atype == "Trusted User" || $atype == "Developer")): ?> - <li><a href="<?= get_pkg_uri($row['Name']) . 'unflag/'; ?>"><?= __('Unflag package'); ?></a></li> + <li> + <form action="<?= get_pkg_uri($row['Name']) . 'unflag/'; ?>" method="post"> + <input type="submit" class="button text-button" name="do_UnFlag" value="<?= __('Unflag package') ?>" /> + </form> + </li> <?php endif; ?> <?php if (user_voted($uid, $row['ID'])): ?> - <li><a href="<?= get_pkg_uri($row['Name']) . 'unvote/'; ?>"><?= __('Remove vote'); ?></a></li> + <li> + <form action="<?= get_pkg_uri($row['Name']) . 'unvote/'; ?>" method="post"> + <input type="submit" class="button text-button" name="do_UnVote" value="<?= __('Remove vote') ?>" /> + </form> + </li> <?php else: ?> - <li><a href="<?= get_pkg_uri($row['Name']) . 'vote/'; ?>"><?= __('Vote for this package'); ?></a></li> + <li> + <form action="<?= get_pkg_uri($row['Name']) . 'vote/'; ?>" method="post"> + <input type="submit" class="button text-button" name="do_Vote" value="<?= __('Vote for this package') ?>" /> + </form> + </li> <?php endif; ?> <?php if (user_notify($uid, $row['ID'])): ?> - <li><a href="<?= get_pkg_uri($row['Name']) . 'unnotify/'; ?>"><?= __('Disable notifications'); ?></a></li> + <li> + <form action="<?= get_pkg_uri($row['Name']) . 'unnotify/'; ?>" method="post"> + <input type="submit" class="button text-button" name="do_UnNotify" value="<?= __('Disable notifications') ?>" /> + </form> + </li> <?php else: ?> - <li><a href="<?= get_pkg_uri($row['Name']) . 'notify/'; ?>"><?= __('Notify of new comments'); ?></a></li> + <li> + <form action="<?= get_pkg_uri($row['Name']) . 'notify/'; ?>" method="post"> + <input type="submit" class="button text-button" name="do_Notify" value="<?= __('Notify of new comments') ?>" /> + </form> + </li> <?php endif; ?> <?php if ($atype == "Trusted User" || $atype == "Developer"): ?> <li><a href="<?= get_pkg_uri($row['Name']) . 'delete/'; ?>"><?= __('Delete Package'); ?></a></li> -- 1.8.4.rc3.500.gc3113b0
We fixed all known CRSF vulnerabilities in commit 2c93f0a (Implement token system to fix CSRF vulnerabilities, 2012-06-23). c349cb2 (Add virtual path support for package actions, 2012-07-17) partly reverted this by injecting a valid CRSF token when virtual paths are in use. This patch allows for keeping the virtual path feature, while reintroducing POST forms and CRSF tokens. Actions like package flagging, votes and notifications are no longer prone to CRSF (see FS#35437 for details). Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> --- web/html/index.php | 4 ---- web/template/pkg_details.php | 6 ++++++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/web/html/index.php b/web/html/index.php index 1cb48ac..be6c98d 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -59,10 +59,6 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { return; } - if (isset($_COOKIE['AURSID'])) { - $_POST['token'] = $_COOKIE['AURSID']; - } - $_POST['IDs'] = array(pkgid_from_name($tokens[2]) => '1'); } } diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index bd54923..0484924 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -41,6 +41,7 @@ $sources = package_sources($row["ID"]); <?php if ($row["OutOfDateTS"] === NULL): ?> <li> <form action="<?= get_pkg_uri($row['Name']) . 'flag/'; ?>" method="post"> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button text-button" name="do_Flag" value="<?= __('Flag package out-of-date') ?>" /> </form> </li> @@ -48,6 +49,7 @@ $sources = package_sources($row["ID"]); ($uid == $row["MaintainerUID"] || $atype == "Trusted User" || $atype == "Developer")): ?> <li> <form action="<?= get_pkg_uri($row['Name']) . 'unflag/'; ?>" method="post"> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button text-button" name="do_UnFlag" value="<?= __('Unflag package') ?>" /> </form> </li> @@ -55,12 +57,14 @@ $sources = package_sources($row["ID"]); <?php if (user_voted($uid, $row['ID'])): ?> <li> <form action="<?= get_pkg_uri($row['Name']) . 'unvote/'; ?>" method="post"> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button text-button" name="do_UnVote" value="<?= __('Remove vote') ?>" /> </form> </li> <?php else: ?> <li> <form action="<?= get_pkg_uri($row['Name']) . 'vote/'; ?>" method="post"> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button text-button" name="do_Vote" value="<?= __('Vote for this package') ?>" /> </form> </li> @@ -68,12 +72,14 @@ $sources = package_sources($row["ID"]); <?php if (user_notify($uid, $row['ID'])): ?> <li> <form action="<?= get_pkg_uri($row['Name']) . 'unnotify/'; ?>" method="post"> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button text-button" name="do_UnNotify" value="<?= __('Disable notifications') ?>" /> </form> </li> <?php else: ?> <li> <form action="<?= get_pkg_uri($row['Name']) . 'notify/'; ?>" method="post"> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button text-button" name="do_Notify" value="<?= __('Notify of new comments') ?>" /> </form> </li> -- 1.8.4.rc3.500.gc3113b0
participants (1)
-
Lukas Fleischer