From b7e943ea900fa0fd6c101c6905985c1be8c6e671 Mon Sep 17 00:00:00 2001 From: Ferywir <65760459+Ferywir@users.noreply.github.com> Date: Sat, 20 Jun 2026 05:44:12 +0200 Subject: [PATCH] fix(admin): wire CSRF token into admin.php-routed forms [#139] (#244) --- Admin/Templates/add_village.tpl | 1 + Admin/Templates/ban.tpl | 2 ++ Admin/Templates/maintenance.tpl | 1 + Admin/Templates/map.tpl | 1 + Admin/Templates/map_tile.tpl | 3 +- Admin/Templates/natars.tpl | 2 ++ Admin/Templates/punish.tpl | 3 ++ Admin/Templates/search.tpl | 1 + Admin/Templates/search2.tpl | 1 + Admin/admin.php | 48 ++++----------------------- GameEngine/Admin/csrf.php | 59 +++++++++++++++++++++++++++++++++ 11 files changed, 79 insertions(+), 43 deletions(-) create mode 100644 GameEngine/Admin/csrf.php diff --git a/Admin/Templates/add_village.tpl b/Admin/Templates/add_village.tpl index ae38886f..bd992823 100644 --- a/Admin/Templates/add_village.tpl +++ b/Admin/Templates/add_village.tpl @@ -57,6 +57,7 @@
+ diff --git a/Admin/Templates/ban.tpl b/Admin/Templates/ban.tpl index b24b026d..1660e591 100644 --- a/Admin/Templates/ban.tpl +++ b/Admin/Templates/ban.tpl @@ -121,6 +121,7 @@ $banHistory = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."banlist Add New Ban +
@@ -174,6 +175,7 @@ $banHistory = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."banlist Ban IP Address +
diff --git a/Admin/Templates/maintenance.tpl b/Admin/Templates/maintenance.tpl index b4ff0c12..ee8cdcfc 100644 --- a/Admin/Templates/maintenance.tpl +++ b/Admin/Templates/maintenance.tpl @@ -60,6 +60,7 @@ if($maint['started_by'] > 0){ '.$error.'
'; ?> +
Server Maintenance
diff --git a/Admin/Templates/map.tpl b/Admin/Templates/map.tpl index fc0d53ba..3104ab94 100644 --- a/Admin/Templates/map.tpl +++ b/Admin/Templates/map.tpl @@ -130,6 +130,7 @@ body{margin:0;background:#f1f5f9;font-family:system-ui,-apple-system,Segoe UI,Ro
+
value="1"> diff --git a/Admin/Templates/map_tile.tpl b/Admin/Templates/map_tile.tpl index 4cc38c4d..f1e8f791 100644 --- a/Admin/Templates/map_tile.tpl +++ b/Admin/Templates/map_tile.tpl @@ -69,7 +69,7 @@ function village_type_by_fieldtype_id($id){ function gen_map_tiles_select_list_form($is_ocuppied,$is_oasis,$oasis_type,$fieldtype,$x,$y){ $not_ocuppied =!$is_ocuppied; - $html = '
New Map Tile Type'; if($is_oasis){ for($i=1;$i<13;$i++){ $sel=($i==$oasis_type)?' selected':''; $html.=''; } if($not_ocuppied){ for($i=1;$i<13;$i++){ $html.=''; } } @@ -158,6 +158,7 @@ elseif(isset($_GET['do_get']) && isset($_POST['x'])){
+
X diff --git a/Admin/Templates/natars.tpl b/Admin/Templates/natars.tpl index 3f306b65..2309f321 100644 --- a/Admin/Templates/natars.tpl +++ b/Admin/Templates/natars.tpl @@ -57,6 +57,7 @@ $deletedArtifacts = $database->getDeletedArtifacts();

๐Ÿฐ WW Villages

+
@@ -74,6 +75,7 @@ $deletedArtifacts = $database->getDeletedArtifacts();

โœจ Add Artifacts

+
NumberPlayer ID
diff --git a/Admin/Templates/punish.tpl b/Admin/Templates/punish.tpl index 11b04ca6..5d69b2e6 100644 --- a/Admin/Templates/punish.tpl +++ b/Admin/Templates/punish.tpl @@ -57,6 +57,7 @@ $active = $admin->getUserActive();
IconTypeQtyPlayer
+ @@ -80,6 +81,7 @@ $active = $admin->getUserActive();
+ @@ -92,6 +94,7 @@ $active = $admin->getUserActive();
+ diff --git a/Admin/Templates/search.tpl b/Admin/Templates/search.tpl index d1902c3f..b52584ae 100644 --- a/Admin/Templates/search.tpl +++ b/Admin/Templates/search.tpl @@ -62,6 +62,7 @@ $search = stripslashes($_POST['s']?? '');
+ diff --git a/Admin/admin.php b/Admin/admin.php index 54eb60a7..339f3a71 100644 --- a/Admin/admin.php +++ b/Admin/admin.php @@ -30,12 +30,10 @@ if (session_status() === PHP_SESSION_NONE) { session_start(); } -// โ”€โ”€โ”€ CSRF TOKEN โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ -// Generat o singurฤƒ datฤƒ per sesiune ศ™i stocat รฎn $_SESSION. -// Toate request-urile POST trebuie sฤƒ trimitฤƒ acest token รฎn cรขmpul _csrf_token. -if (empty($_SESSION['_csrf_token'])) { - $_SESSION['_csrf_token'] = bin2hex(random_bytes(32)); -} +// โ”€โ”€โ”€ CSRF PROTECTION โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ +// Token init + csrf_token()/csrf_field()/csrf_verify() helpers, shared with the +// admin Mods (which are POSTed to directly). See GameEngine/Admin/csrf.php. +include_once("../GameEngine/Admin/csrf.php"); // โ”€โ”€โ”€ CORE INCLUDES โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ include_once("../GameEngine/config.php"); @@ -97,42 +95,8 @@ function admin_validated_page(string $raw): string return in_array($raw, $whitelist, true) ? $raw : ''; } -/** - * Returneazฤƒ token-ul CSRF curent ca string hex. - * Folosit pentru injectare รฎn cรขmpuri ascunse sau header-e AJAX. - */ -function csrf_token(): string -{ - return $_SESSION['_csrf_token'] ?? ''; -} - -/** - * Emite un gata de pus รฎn orice POST din template-uri. - * Exemplu de utilizare รฎn .tpl: - */ -function csrf_field(): string -{ - return ''; -} - -/** - * Verificฤƒ token-ul CSRF dintr-un request POST. - * Opreศ™te execuศ›ia cu HTTP 403 dacฤƒ token-ul lipseศ™te sau nu se potriveศ™te. - * Apelatฤƒ automat pe orice $_POST โ€” nu trebuie apelatฤƒ manual รฎn template-uri. - * - * Folosim hash_equals() รฎn loc de === pentru a preveni timing attacks. - */ -function csrf_verify(): void -{ - $submitted = isset($_POST['_csrf_token']) ? (string)$_POST['_csrf_token'] : ''; - $stored = csrf_token(); - - if ($stored === '' || !hash_equals($stored, $submitted)) { - http_response_code(403); - // Mesaj generic โ€” nu dezvฤƒluie detalii despre mecanism - die('

403 Forbidden

Invalid or missing security token. Please go back and try again.

'); - } -} +// CSRF helpers โ€” csrf_token() / csrf_field() / csrf_verify() โ€” are defined in +// GameEngine/Admin/csrf.php (included above), shared with the admin Mods. /** * Look up a user row by ID using a prepared statement. diff --git a/GameEngine/Admin/csrf.php b/GameEngine/Admin/csrf.php new file mode 100644 index 00000000..fc8a50ac --- /dev/null +++ b/GameEngine/Admin/csrf.php @@ -0,0 +1,59 @@ + to drop into any POST + * - csrf_verify(): abort with HTTP 403 if the POSTed token is missing/invalid + */ + +// Defensive: callers normally start the session themselves, but make sure we +// have one to store the token in. +if (session_status() !== PHP_SESSION_ACTIVE) { + session_start(); +} + +// Generate the token once per session. +if (empty($_SESSION['_csrf_token'])) { + $_SESSION['_csrf_token'] = bin2hex(random_bytes(32)); +} + +if (!function_exists('csrf_token')) { + /** + * Return the current CSRF token as a hex string. + */ + function csrf_token(): string + { + return $_SESSION['_csrf_token'] ?? ''; + } + + /** + * Emit a ready-to-use hidden for any POST in a template. + * Usage in a .tpl: + */ + function csrf_field(): string + { + return ''; + } + + /** + * Verify the CSRF token of a POST request. + * Stops execution with HTTP 403 if the token is missing or does not match. + * Uses hash_equals() instead of === to prevent timing attacks. + */ + function csrf_verify(): void + { + $submitted = isset($_POST['_csrf_token']) ? (string)$_POST['_csrf_token'] : ''; + $stored = csrf_token(); + + if ($stored === '' || !hash_equals($stored, $submitted)) { + http_response_code(403); + // Generic message โ€” does not reveal details about the mechanism. + die('

403 Forbidden

Invalid or missing security token. Please go back and try again.

'); + } + } +}