<![CDATA[PunBB Forums — CSRF in common.php question...]]> https://punbb.informer.com/forums/topic/18404/csrf-in-commonphp-question/ Mon, 25 Feb 2008 19:06:28 +0000 PunBB <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/110440/#p110440 StevenBullen wrote:
intedinmamma wrote:

One solution is to have a "proxy script", which just adds the CSRF token and sends it all along to wherever it should go.

Will this work on 100% of what PunBB 1.3 will work on? I am positive not all people/hosting lets you run proxy scripts etc.

It should be quite easy as long as you can use fsockopen(). (available in both PHP4 & 5) Doing it that way you will just have to resend the POST data along with a CSRF token, check php.net for examples on doing the harder half of it.

]]> Mon, 25 Feb 2008 19:06:28 +0000 https://punbb.informer.com/forums/post/110440/#p110440 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/110438/#p110438 intedinmamma wrote:

One solution is to have a "proxy script", which just adds the CSRF token and sends it all along to wherever it should go.

Will this work on 100% of what PunBB 1.3 will work on? I am positive not all people/hosting lets you run proxy scripts etc.

]]> Mon, 25 Feb 2008 18:00:00 +0000 https://punbb.informer.com/forums/post/110438/#p110438 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/110421/#p110421 StevenBullen wrote:

Any idea of a way around this?

intedinmamma wrote:

One solution is to have a "proxy script", which just adds the CSRF token and sends it all along to wherever it should go.

smile

]]> Mon, 25 Feb 2008 13:54:26 +0000 https://punbb.informer.com/forums/post/110421/#p110421 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/110416/#p110416 No, for security reasons there is no way around it.

]]> Mon, 25 Feb 2008 11:25:22 +0000 https://punbb.informer.com/forums/post/110416/#p110416 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/110403/#p110403 Smartys wrote:

game.swf?csrf_token=foo
You can't get the value of csrf_token from that?

Yeah but doing this I will still need to edit all the games to POST the csrf_token. Correct?

I done a few and this works fine. But I have no interest in doing all the games.
Any idea of a way around this?

]]> Mon, 25 Feb 2008 06:24:47 +0000 https://punbb.informer.com/forums/post/110403/#p110403 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109977/#p109977 Thanks, corrected smile

]]> Mon, 18 Feb 2008 23:57:54 +0000 https://punbb.informer.com/forums/post/109977/#p109977 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109976/#p109976 Smartys wrote:

No, it's very simple. You should be able to understand it just by looking at the code. wink
Basically, when POSTing, you need to include a hidden field. The name should be csrf_token and the value should be the output of the function generate_csrf_token. The function takes one parameter, which is the absolute URL of the page you're submitting to.

Thanks Smartys, I was actually using the relative path.

(sidenote: the function's name is generate_form_token, not generate_csrf_token, just for those wondering).

]]> Mon, 18 Feb 2008 23:52:46 +0000 https://punbb.informer.com/forums/post/109976/#p109976 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109975/#p109975 No, it's very simple. You should be able to understand it just by looking at the code. wink
Basically, when POSTing, you need to include a hidden field. The name should be csrf_token and the value should be the output of the function generate_form_token. The function takes one parameter, which is the absolute URL of the page you're submitting to.

Edit: Corrected the function name

]]> Mon, 18 Feb 2008 23:35:14 +0000 https://punbb.informer.com/forums/post/109975/#p109975 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109973/#p109973 Smartys wrote:

You can't get around the CSRF check. You need to implement it.

Can you explain how to do that or is too complicated?

]]> Mon, 18 Feb 2008 23:31:42 +0000 https://punbb.informer.com/forums/post/109973/#p109973 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109704/#p109704 One solution is to have a "proxy script", which just adds the CSRF token and sends it all along to wherever it should go.

]]> Thu, 14 Feb 2008 13:23:40 +0000 https://punbb.informer.com/forums/post/109704/#p109704 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109698/#p109698 game.swf?csrf_token=foo
You can't get the value of csrf_token from that?

]]> Thu, 14 Feb 2008 11:39:20 +0000 https://punbb.informer.com/forums/post/109698/#p109698 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109697/#p109697 The posting is done from the flash object not from the page. Correct? Which means anything I have passed to the page will not be passed via the submit score button. Unless im missing something. Which is probably whats happening here... smile

]]> Thu, 14 Feb 2008 11:30:46 +0000 https://punbb.informer.com/forums/post/109697/#p109697 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109696/#p109696 When you're writing your own arcade.php file you can't add a call to the CSRF generation function in the right place? o.O

]]> Thu, 14 Feb 2008 11:24:21 +0000 https://punbb.informer.com/forums/post/109696/#p109696 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109695/#p109695 Smartys wrote:

I have absolutely no idea. But I don't see why you can't pass the game the proper CSRF token via the URL and then have it use that when POSTing.

This is probably possible... But not really the ideal for 300 or so games. It would take me years... tongue

This is a little worrying because I cant even get round it lol. The hook wont let me as its after it lol.

]]> Thu, 14 Feb 2008 11:23:30 +0000 https://punbb.informer.com/forums/post/109695/#p109695 <![CDATA[Re: CSRF in common.php question...]]> https://punbb.informer.com/forums/post/109694/#p109694 I have absolutely no idea. But I don't see why you can't pass the game the proper CSRF token via the URL and then have it use that when POSTing.

]]> Thu, 14 Feb 2008 11:21:49 +0000 https://punbb.informer.com/forums/post/109694/#p109694