diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html index 047d95f7b7..83149ca9fc 100644 --- a/phpBB/docs/CHANGELOG.html +++ b/phpBB/docs/CHANGELOG.html @@ -132,6 +132,7 @@ h3 {font-size:12pt;color:blue}
  • Fixed use of missing CSS classes in modcp_split, group_info_body, error_body and agreement
  • Fixed ability of users to edit polls even after they have received votes
  • Fixed header Location to be absolute URL as per HTTP 1.1 spec - noted by PhilippK
    • +
  • Added additional session_id checks to MCP, topic subscription, PM and similar items
  • diff --git a/phpBB/groupcp.php b/phpBB/groupcp.php index 7bdd76aae4..d98638291a 100644 --- a/phpBB/groupcp.php +++ b/phpBB/groupcp.php @@ -160,6 +160,11 @@ if ( isset($HTTP_POST_VARS['groupstatus']) && $group_id ) redirect(append_sid("login.$phpEx?redirect=groupcp.$phpEx&" . POST_GROUPS_URL . "=$group_id", true)); } + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) + { + message_die(ERROR, 'Invalid_session'); + } + $sql = "SELECT group_moderator FROM " . GROUPS_TABLE . " WHERE group_id = $group_id"; @@ -209,6 +214,11 @@ else if ( isset($HTTP_POST_VARS['joingroup']) && $group_id ) redirect(append_sid("login.$phpEx?redirect=groupcp.$phpEx&" . POST_GROUPS_URL . "=$group_id", true)); } + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) + { + message_die(ERROR, 'Invalid_session'); + } + $sql = "SELECT ug.user_id, g.group_type FROM " . USER_GROUP_TABLE . " ug, " . GROUPS_TABLE . " g WHERE g.group_id = $group_id @@ -314,6 +324,11 @@ else if ( isset($HTTP_POST_VARS['unsub']) || isset($HTTP_POST_VARS['unsubpending redirect(append_sid("login.$phpEx?redirect=groupcp.$phpEx&" . POST_GROUPS_URL . "=$group_id", true)); } + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) + { + message_die(ERROR, 'Invalid_session'); + } + if ( $confirm ) { $sql = "DELETE FROM " . USER_GROUP_TABLE . " @@ -360,7 +375,7 @@ else if ( isset($HTTP_POST_VARS['unsub']) || isset($HTTP_POST_VARS['unsubpending { $unsub_msg = ( isset($HTTP_POST_VARS['unsub']) ) ? $lang['Confirm_unsub'] : $lang['Confirm_unsub_pending']; - $s_hidden_fields = ''; + $s_hidden_fields = ''; $page_title = $lang['Group_Control_Panel']; include($phpbb_root_path . 'includes/page_header.'.$phpEx); @@ -458,6 +473,11 @@ else if ( $group_id ) redirect(append_sid("login.$phpEx?redirect=groupcp.$phpEx&" . POST_GROUPS_URL . "=$group_id", true)); } + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) + { + message_die(ERROR, 'Invalid_session'); + } + if ( !$is_moderator ) { $template->assign_vars(array( @@ -892,6 +912,8 @@ else if ( $group_id ) generate_user_info($group_moderator, $board_config['default_dateformat'], $is_moderator, $from, $posts, $joined, $poster_avatar, $profile_img, $profile, $search_img, $search, $pm_img, $pm, $email_img, $email, $www_img, $www, $icq_status_img, $icq_img, $icq, $aim_img, $aim, $msn_img, $msn, $yim_img, $yim); + $s_hidden_fields .= ''; + $template->assign_vars(array( 'L_GROUP_INFORMATION' => $lang['Group_Information'], 'L_GROUP_NAME' => $lang['Group_name'], @@ -1236,11 +1258,7 @@ else $template->assign_block_vars('switch_groups_remaining', array() ); } - $s_hidden_fields = ''; - if ( !empty($SID) ) - { - $s_hidden_fields .= ''; - } + $s_hidden_fields = ''; $template->assign_vars(array( 'L_GROUP_MEMBERSHIP_DETAILS' => $lang['Group_member_details'], diff --git a/phpBB/includes/usercp_email.php b/phpBB/includes/usercp_email.php index 4df0ec4bde..4c86664b79 100644 --- a/phpBB/includes/usercp_email.php +++ b/phpBB/includes/usercp_email.php @@ -61,7 +61,7 @@ if ( $result = $db->sql_query($sql) ) if ( isset($HTTP_POST_VARS['submit']) ) { - if (!isset($HTTP_POST_VARS['session_id']) || $HTTP_POST_VARS['session_id'] != $userdata['session_id']) + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) { message_die(ERROR, 'Invalid_session'); } @@ -174,7 +174,7 @@ if ( $result = $db->sql_query($sql) ) $template->assign_vars(array( 'USERNAME' => $username, - 'S_HIDDEN_FIELDS' => '', + 'S_HIDDEN_FIELDS' => '', 'S_POST_ACTION' => append_sid("profile.$phpEx?&mode=email&" . POST_USERS_URL . "=$user_id"), 'L_SEND_EMAIL_MSG' => $lang['Send_email_msg'], diff --git a/phpBB/includes/usercp_register.php b/phpBB/includes/usercp_register.php index f845434110..bc7a5c9ca3 100644 --- a/phpBB/includes/usercp_register.php +++ b/phpBB/includes/usercp_register.php @@ -80,7 +80,7 @@ if ( isset($HTTP_POST_VARS['cancelavatar']) || $mode == 'register' ) { - if (!isset($HTTP_POST_VARS['session_id']) || $HTTP_POST_VARS['session_id'] != $userdata['session_id']) + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) { message_die(ERROR, 'Invalid_session_id'); } @@ -771,7 +771,7 @@ else } } - $s_hidden_fields = ''; + $s_hidden_fields = ''; if( $mode == 'editprofile' ) { $s_hidden_fields .= ''; diff --git a/phpBB/includes/usercp_sendpasswd.php b/phpBB/includes/usercp_sendpasswd.php index ff3b2c05fa..3399c081f7 100644 --- a/phpBB/includes/usercp_sendpasswd.php +++ b/phpBB/includes/usercp_sendpasswd.php @@ -29,6 +29,11 @@ if ( !defined('IN_PHPBB') ) if ( isset($HTTP_POST_VARS['submit']) ) { + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) + { + message_die(ERROR, 'Invalid_session'); + } + $username = ( !empty($HTTP_POST_VARS['username']) ) ? trim(strip_tags($HTTP_POST_VARS['username'])) : ''; $email = ( !empty($HTTP_POST_VARS['email']) ) ? trim(strip_tags(htmlspecialchars($HTTP_POST_VARS['email']))) : ''; @@ -127,6 +132,7 @@ $template->assign_vars(array( 'L_SUBMIT' => $lang['Submit'], 'L_RESET' => $lang['Reset'], + 'S_HIDDEN_FIELDS' => '', 'S_PROFILE_ACTION' => append_sid("profile.$phpEx?mode=sendpassword")) ); diff --git a/phpBB/modcp.php b/phpBB/modcp.php index 31e52796bb..a092461747 100644 --- a/phpBB/modcp.php +++ b/phpBB/modcp.php @@ -105,6 +105,16 @@ else } } +// session id check +if (!empty($HTTP_POST_VARS['sid']) || !empty($HTTP_GET_VARS['sid'])) +{ + $sid = (!empty($HTTP_POST_VARS['sid'])) ? $HTTP_POST_VARS['sid'] : $HTTP_GET_VARS['sid']; +} +else +{ + $sid = ''; +} + // // Obtain relevant data // @@ -152,6 +162,12 @@ init_userprefs($userdata); // End session management // +// session id check +if ($sid == '' || $sid != $userdata['session_id']) +{ + message_die(ERROR, 'Invalid_session'); +} + // // Check if user did or did not confirm // If they did not, forward them to the last page they were on @@ -344,12 +360,12 @@ switch( $mode ) if ( !empty($topic_id) ) { - $redirect_page = append_sid("viewforum.$phpEx?" . POST_FORUM_URL . "=$forum_id"); + $redirect_page = "viewforum.$phpEx?" . POST_FORUM_URL . "=$forum_id&sid=" . $userdata['session_id']; $l_redirect = sprintf($lang['Click_return_forum'], '', ''); } else { - $redirect_page = append_sid("modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id"); + $redirect_page = "modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id&sid=" . $userdata['session_id']; $l_redirect = sprintf($lang['Click_return_modcp'], '', ''); } @@ -367,7 +383,7 @@ switch( $mode ) message_die(GENERAL_MESSAGE, $lang['None_selected']); } - $hidden_fields = ''; + $hidden_fields = ''; if ( isset($HTTP_POST_VARS['topic_id_list']) ) { @@ -488,16 +504,16 @@ switch( $mode ) if ( !empty($topic_id) ) { - $redirect_page = append_sid("viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id"); + $redirect_page = "viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id&sid=" . $userdata['session_id']; $message .= sprintf($lang['Click_return_topic'], '', ''); } else { - $redirect_page = append_sid("modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id"); + $redirect_page = "modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id&sid=" . $userdata['session_id']; $message .= sprintf($lang['Click_return_modcp'], '', ''); } - $message = $message . '

    ' . sprintf($lang['Click_return_forum'], '', ''); + $message = $message . '

    ' . sprintf($lang['Click_return_forum'], '', ''); $template->assign_vars(array( 'META' => '') @@ -512,7 +528,7 @@ switch( $mode ) message_die(GENERAL_MESSAGE, $lang['None_selected']); } - $hidden_fields = ''; + $hidden_fields = ''; if ( isset($HTTP_POST_VARS['topic_id_list']) ) { @@ -580,16 +596,16 @@ switch( $mode ) if ( !empty($topic_id) ) { - $redirect_page = append_sid("viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id"); + $redirect_page = "viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id&sid=" . $userdata['session_id']; $message = sprintf($lang['Click_return_topic'], '', ''); } else { - $redirect_page = append_sid("modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id"); + $redirect_page = "modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id&sid=" . $userdata['session_id']; $message = sprintf($lang['Click_return_modcp'], '', ''); } - $message = $message . '

    ' . sprintf($lang['Click_return_forum'], '', ''); + $message = $message . '

    ' . sprintf($lang['Click_return_forum'], '', ''); $template->assign_vars(array( 'META' => '') @@ -624,16 +640,16 @@ switch( $mode ) if ( !empty($topic_id) ) { - $redirect_page = append_sid("viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id"); + $redirect_page = "viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id&sid=" . $userdata['session_id']; $message = sprintf($lang['Click_return_topic'], '', ''); } else { - $redirect_page = append_sid("modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id"); + $redirect_page = "modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id&sid=" . $userdata['session_id']; $message = sprintf($lang['Click_return_modcp'], '', ''); } - $message = $message . '

    ' . sprintf($lang['Click_return_forum'], '', ''); + $message = $message . '

    ' . sprintf($lang['Click_return_forum'], '', ''); $template->assign_vars(array( 'META' => '') @@ -713,10 +729,10 @@ switch( $mode ) sync('forum', $forum_id); $template->assign_vars(array( - 'META' => '') + 'META' => '') ); - $message = $lang['Topic_split'] . '

    ' . sprintf($lang['Click_return_topic'], '', ''); + $message = $lang['Topic_split'] . '

    ' . sprintf($lang['Click_return_topic'], '', ''); message_die(GENERAL_MESSAGE, $message); } else @@ -739,7 +755,7 @@ switch( $mode ) message_die(GENERAL_ERROR, 'Could not get topic/post information', '', __LINE__, __FILE__, $sql); } - $s_hidden_fields = ''; + $s_hidden_fields = ''; if( ( $total_posts = $db->sql_numrows($result) ) > 0 ) { @@ -894,7 +910,7 @@ switch( $mode ) 'IP' => $ip_this_post, - 'U_LOOKUP_IP' => append_sid("modcp.$phpEx?mode=ip&" . POST_POST_URL . "=$post_id&" . POST_TOPIC_URL . "=$topic_id&rdns=" . $ip_this_post)) + 'U_LOOKUP_IP' => "modcp.$phpEx?mode=ip&" . POST_POST_URL . "=$post_id&" . POST_TOPIC_URL . "=$topic_id&rdns=$ip_this_post&sid=" . $userdata['session_id']) ); // @@ -935,7 +951,7 @@ switch( $mode ) 'IP' => $ip, 'POSTS' => $row['postings'] . ' ' . ( ( $row['postings'] == 1 ) ? $lang['Post'] : $lang['Posts'] ), - 'U_LOOKUP_IP' => append_sid("modcp.$phpEx?mode=ip&" . POST_POST_URL . "=$post_id&" . POST_TOPIC_URL . "=$topic_id&rdns=" . $row['poster_ip'])) + 'U_LOOKUP_IP' => "modcp.$phpEx?mode=ip&" . POST_POST_URL . "=$post_id&" . POST_TOPIC_URL . "=$topic_id&rdns=" . $row['poster_ip'] . "&sid=" . $userdata['session_id']) ); $i++; @@ -1008,7 +1024,7 @@ switch( $mode ) 'L_SELECT' => $lang['Select'], 'U_VIEW_FORUM' => append_sid("viewforum.$phpEx?" . POST_FORUM_URL . "=$forum_id"), - 'S_HIDDEN_FIELDS' => '', + 'S_HIDDEN_FIELDS' => '', 'S_MODCP_ACTION' => append_sid("modcp.$phpEx")) ); @@ -1096,7 +1112,7 @@ switch( $mode ) $topic_title = preg_replace($orig_word, $replacement_word, $topic_title); } - $u_view_topic = append_sid("modcp.$phpEx?mode=split&" . POST_TOPIC_URL . "=$topic_id"); + $u_view_topic = "modcp.$phpEx?mode=split&" . POST_TOPIC_URL . "=$topic_id&sid=" . $userdata['session_id']; $topic_replies = $row['topic_replies']; $last_post_time = create_date($board_config['default_dateformat'], $row['post_time'], $board_config['board_timezone']); diff --git a/phpBB/posting.php b/phpBB/posting.php index 6c21757511..2cfd897711 100644 --- a/phpBB/posting.php +++ b/phpBB/posting.php @@ -130,7 +130,7 @@ if ( isset($HTTP_POST_VARS['cancel']) ) // if ( $submit || $refresh ) { - if (!isset($HTTP_POST_VARS['session_id']) || $HTTP_POST_VARS['session_id'] != $userdata['session_id']) + if (!isset($HTTP_POST_VARS['sid']) || $HTTP_POST_VARS['sid'] != $userdata['session_id']) { // I've not added this to the language set at this time ... re-releasing // every single language to include this for the once in a blue moon @@ -434,7 +434,7 @@ if ( ( $delete || $poll_delete || $mode == 'delete' ) && !$confirm ) // // Confirm deletion // - $s_hidden_fields = ''; + $s_hidden_fields = ''; $s_hidden_fields .= ( $delete || $mode == "delete" ) ? '' : ''; $l_confirm = ( $delete || $mode == 'delete' ) ? $lang['Confirm_delete'] : $lang['Confirm_delete_poll']; @@ -926,7 +926,7 @@ if ( $mode == 'newtopic' || ( $mode == 'editpost' && $post_data['first_post'] ) } } -$hidden_form_fields = ''; +$hidden_form_fields = ''; switch( $mode ) { diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php index 843a8edba6..a418369796 100644 --- a/phpBB/viewtopic.php +++ b/phpBB/viewtopic.php @@ -578,15 +578,15 @@ $topic_mod = ''; if ( $is_auth['auth_mod'] ) { - $s_auth_can .= sprintf($lang['Rules_moderate'], '', ''); + $s_auth_can .= sprintf($lang['Rules_moderate'], "', ''); - $topic_mod .= '' . $lang['Delete_topic'] . ' '; + $topic_mod .= "' . $lang['Delete_topic'] . ' '; - $topic_mod .= '' . $lang['Move_topic'] . ' '; + $topic_mod .= "' . $lang['Move_topic'] . ' '; - $topic_mod .= ( $forum_topic_data['topic_status'] == TOPIC_UNLOCKED ) ? '' . $lang['Lock_topic'] . ' ' : '' . $lang['Unlock_topic'] . ' '; + $topic_mod .= ( $forum_topic_data['topic_status'] == TOPIC_UNLOCKED ) ? "' . $lang['Lock_topic'] . ' ' : "' . $lang['Unlock_topic'] . ' '; - $topic_mod .= '' . $lang['Split_topic'] . ' '; + $topic_mod .= "' . $lang['Split_topic'] . ' '; } // @@ -597,13 +597,13 @@ if ( $can_watch_topic ) { if ( $is_watching_topic ) { - $s_watching_topic = '' . $lang['Stop_watching_topic'] . ''; - $s_watching_topic_img = ( isset($images['Topic_un_watch']) ) ? '' . $lang['Stop_watching_topic'] . '' : ''; + $s_watching_topic = "' . $lang['Stop_watching_topic'] . ''; + $s_watching_topic_img = ( isset($images['Topic_un_watch']) ) ? "' . $lang['Stop_watching_topic'] . '' : ''; } else { - $s_watching_topic = '' . $lang['Start_watching_topic'] . ''; - $s_watching_topic_img = ( isset($images['Topic_watch']) ) ? '' . $lang['Start_watching_topic'] . '' : ''; + $s_watching_topic = "' . $lang['Start_watching_topic'] . ''; + $s_watching_topic_img = ( isset($images['Topic_watch']) ) ? "' . $lang['Start_watching_topic'] . '' : ''; } } @@ -665,6 +665,8 @@ $template->assign_vars(array( // if ( !empty($forum_topic_data['topic_vote']) ) { + $s_hidden_fields = ''; + $sql = "SELECT vd.vote_id, vd.vote_text, vd.vote_start, vd.vote_length, vr.vote_option_id, vr.vote_option_text, vr.vote_result FROM " . VOTE_DESC_TABLE . " vd, " . VOTE_RESULTS_TABLE . " vr WHERE vd.topic_id = $topic_id @@ -785,10 +787,12 @@ if ( !empty($forum_topic_data['topic_vote']) ) $vote_title = preg_replace($orig_word, $replacement_word, $vote_title); } + $s_hidden_fields = ''; + $template->assign_vars(array( 'POLL_QUESTION' => $vote_title, - 'S_HIDDEN_FIELDS' => ( !empty($s_hidden_fields) ) ? $s_hidden_fields : '', + 'S_HIDDEN_FIELDS' => $s_hidden_fields, 'S_POLL_ACTION' => append_sid("posting.$phpEx?" . POST_TOPIC_URL . "=$topic_id")) );