From 5c2492e78599760b256f6f3958e5e30ff40bf54f Mon Sep 17 00:00:00 2001 From: Joe Haig Date: Fri, 24 Jun 2016 22:39:39 +0100 Subject: [PATCH] Add CSRF token to password change page --- includes/admin.php | 39 ++++++++++++++++++++++----------------- includes/functions.php | 20 ++++++++++++++++++++ index.php | 10 ++++++++++ 3 files changed, 52 insertions(+), 17 deletions(-) diff --git a/includes/admin.php b/includes/admin.php index a13f9bb..513473e 100755 --- a/includes/admin.php +++ b/includes/admin.php @@ -13,26 +13,30 @@ function Status($message, $level='success', $dismissable=true) { function DisplayAuthConfig($username, $password){ $status = ''; if (isset($_POST['UpdateAdminPassword'])) { - if (password_verify($_POST['oldpass'], $password)) { - $new_username=trim($_POST['username']); - if ($_POST['newpass'] != $_POST['newpassagain']) { - $status = Status('New passwords do not match', 'danger'); - } else if ($new_username == '') { - $status = Status('Username must not be empty', 'danger'); - } else { - if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) { - fwrite($auth_file, $new_username.PHP_EOL); - fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL); - fclose($auth_file); - $username = $new_username; - $status = Status('Admin password updated'); + if (CSRFValidate()) { + if (password_verify($_POST['oldpass'], $password)) { + $new_username=trim($_POST['username']); + if ($_POST['newpass'] != $_POST['newpassagain']) { + $status = Status('New passwords do not match', 'danger'); + } else if ($new_username == '') { + $status = Status('Username must not be empty', 'danger'); } else { - $status = Status('Failed to update admin password', 'danger'); + if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) { + fwrite($auth_file, $new_username.PHP_EOL); + fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL); + fclose($auth_file); + $username = $new_username; + $status = Status('Admin password updated'); + } else { + $status = Status('Failed to update admin password', 'danger'); + } } + } else { + $status = Status('Old password does not match', 'danger'); } - } else { - $status = Status('Old password does not match', 'danger'); - } + } else { + // Log something + } } ?>
@@ -42,6 +46,7 @@ function DisplayAuthConfig($username, $password){

+
diff --git a/includes/functions.php b/includes/functions.php index 0edc493..72abadc 100755 --- a/includes/functions.php +++ b/includes/functions.php @@ -1,5 +1,25 @@ + +