Fix CSRF validation for sorting in property tables

Icinga · Jul 30, 2024 · ae2b0c8 · ae2b0c8
1 parent 428a49f
commit ae2b0c8
Show file tree

Hide file tree

Showing 3 changed files with 63 additions and 3 deletions.
diff --git a/library/Director/Web/Form/PropertyTableSortForm.php b/library/Director/Web/Form/PropertyTableSortForm.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace Icinga\Module\Director\Web\Form;
+
+use ipl\Html\Form;
+use ipl\Html\ValidHtml;
+
+class PropertyTableSortForm extends Form
+{
+    /** @var string Name of the form */
+    private $name;
+
+    /** @var ValidHtml Property table to sort */
+    private $table;
+
+    public function __construct(string $name, ValidHtml $table)
+    {
+        $this->name = $name;
+        $this->table = $table;
+    }
+
+    protected function assemble()
+    {
+        $this->addElement('hidden', '__FORM_NAME', ['value' => $this->name]);
+        $this->addElement('hidden', '__FORM_CSRF', ['value' => CsrfToken::generate()]);
+        $this->addHtml($this->table);
+    }
+}
diff --git a/library/Director/Web/Table/PropertymodifierTable.php b/library/Director/Web/Table/PropertymodifierTable.php
@@ -10,6 +10,10 @@
 use gipfl\IcingaWeb2\Table\Extension\ZfSortablePriority;
 use gipfl\IcingaWeb2\Table\ZfQueryBasedTable;
 use gipfl\IcingaWeb2\Url;
+use Icinga\Module\Director\Web\Form\CsrfToken;
+use Icinga\Module\Director\Web\Form\PropertyTableSortForm;
+use Icinga\Module\Director\Web\Form\QuickForm;
+use ipl\Html\HtmlString;
 
 class PropertymodifierTable extends ZfQueryBasedTable
 {
@@ -48,10 +52,20 @@ public function setReadOnly($readOnly = true)
 
     public function render()
     {
-        if ($this->readOnly) {
+        if ($this->readOnly || $this->request === null) {
             return parent::render();
+        } elseif ($this->request->isPost() && $this->hasBeenSent($this->request)) {
+            if (! CsrfToken::isValid((string) $this->request->get(QuickForm::CSRF))) {
+                die('Invalid CSRF token provided');
+            }
+
+            $this->reallyHandleSortPriorityActions();
         }
-        return $this->renderWithSortableForm();
+
+        $form = (new PropertyTableSortForm($this->getUniqueFormName(), new HtmlString(parent::render())))
+            ->setAction($this->request->getUrl()->getAbsoluteUrl());
+
+        return $form->render();
     }
 
     protected function assemble()

diff --git a/library/Director/Web/Table/SyncpropertyTable.php b/library/Director/Web/Table/SyncpropertyTable.php
@@ -6,6 +6,11 @@
 use gipfl\IcingaWeb2\Link;
 use gipfl\IcingaWeb2\Table\Extension\ZfSortablePriority;
 use gipfl\IcingaWeb2\Table\ZfQueryBasedTable;
+use Icinga\Module\Director\Web\Form\CsrfToken;
+use Icinga\Module\Director\Web\Form\PropertyTableSortForm;
+use Icinga\Module\Director\Web\Form\QuickForm;
+use ipl\Html\Form;
+use ipl\Html\HtmlString;
 
 class SyncpropertyTable extends ZfQueryBasedTable
 {
@@ -33,7 +38,20 @@ public static function create(SyncRule $rule)
 
     public function render()
     {
-        return $this->renderWithSortableForm();
+        if ($this->request === null) {
+            return parent::render();
+        } elseif ($this->request->isPost() && $this->hasBeenSent($this->request)) {
+            if (! CsrfToken::isValid((string) $this->request->get(QuickForm::CSRF))) {
+                die('Invalid CSRF token provided');
+            }
+
+            $this->reallyHandleSortPriorityActions();
+        }
+
+        $form = (new PropertyTableSortForm($this->getUniqueFormName(), new HtmlString(parent::render())))
+            ->setAction($this->request->getUrl()->getAbsoluteUrl());
+
+        return $form->render();
     }
 
     public function renderRow($row)