Changeset 614 for branches/samba-3.3.x/source/web/swat.c

Timestamp:

Jul 27, 2011, 5:37:12 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.16 (security update)

File:

• branches/samba-3.3.x/source/web/swat.c (modified) (23 diffs)

branches/samba-3.3.x/source/web/swat.c

@@ -51 +51 @@
 #define ENABLE_USER_FLAG "enable_user_flag"
 #define RHOST "remote_host"
+#define XSRF_TOKEN "xsrf"
+#define XSRF_TIME "xsrf_time"
+#define XSRF_TIMEOUT 300
 
 #define _(x) lang_msg_rotate(talloc_tos(),x)
@@ -138 +141 @@
         return parmname;
 }
+
+void get_xsrf_token(const char *username, const char *pass,
+                    const char *formname, time_t xsrf_time, char token_str[33])
+{
+        struct MD5Context md5_ctx;
+        uint8_t token[16];
+        int i;
+
+        token_str[0] = '\0';
+        ZERO_STRUCT(md5_ctx);
+        MD5Init(&md5_ctx);
+
+        MD5Update(&md5_ctx, (uint8_t *)formname, strlen(formname));
+        MD5Update(&md5_ctx, (uint8_t *)&xsrf_time, sizeof(time_t));
+        if (username != NULL) {
+                MD5Update(&md5_ctx, (uint8_t *)username, strlen(username));
+        }
+        if (pass != NULL) {
+                MD5Update(&md5_ctx, (uint8_t *)pass, strlen(pass));
+        }
+
+        MD5Final(token, &md5_ctx);
+
+        for(i = 0; i < sizeof(token); i++) {
+                char tmp[3];
+
+                snprintf(tmp, sizeof(tmp), "%02x", token[i]);
+                strncat(token_str, tmp, sizeof(tmp));
+        }
+}
+
+void print_xsrf_token(const char *username, const char *pass,
+                      const char *formname)
+{
+        char token[33];
+        time_t xsrf_time = time(NULL);
+
+        get_xsrf_token(username, pass, formname, xsrf_time, token);
+        printf("<input type=\"hidden\" name=\"%s\" value=\"%s\">\n",
+               XSRF_TOKEN, token);
+        printf("<input type=\"hidden\" name=\"%s\" value=\"%lld\">\n",
+               XSRF_TIME, (long long int)xsrf_time);
+}
+
+bool verify_xsrf_token(const char *formname)
+{
+        char expected[33];
+        const char *username = cgi_user_name();
+        const char *pass = cgi_user_pass();
+        const char *token = cgi_variable_nonull(XSRF_TOKEN);
+        const char *time_str = cgi_variable_nonull(XSRF_TIME);
+        time_t xsrf_time = 0;
+        time_t now = time(NULL);
+
+        if (sizeof(time_t) == sizeof(int)) {
+                xsrf_time = atoi(time_str);
+        } else if (sizeof(time_t) == sizeof(long)) {
+                xsrf_time = atol(time_str);
+        } else if (sizeof(time_t) == sizeof(long long)) {
+                xsrf_time = atoll(time_str);
+        }
+
+        if (abs(now - xsrf_time) > XSRF_TIMEOUT) {
+                return false;
+        }
+
+        get_xsrf_token(username, pass, formname, xsrf_time, expected);
+        return (strncmp(expected, token, sizeof(expected)) == 0);
+}
+
 
 /****************************************************************************
@@ -611 +684 @@
 {
         int full_view=0;
+        const char form_name[] = "viewconfig";
+
+        if (!verify_xsrf_token(form_name)) {
+                goto output_page;
+        }
 
         if (cgi_variable("full_view")) {
@@ -616 +694 @@
         }
 
+output_page:
         printf("<H2>%s</H2>\n", _("Current Config"));
         printf("<form method=post>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
         if (full_view) {
@@ -637 +717 @@
 {
         unsigned int parm_filter = FLAG_WIZARD;
+        const char form_name[] = "wizard_params";
 
         /* Here we first set and commit all the parameters that were selected
@@ -642 +723 @@
 
         printf("<H2>%s</H2>\n", _("Wizard Parameter Edit Page"));
+
+        if (!verify_xsrf_token(form_name)) {
+                goto output_page;
+        }
 
         if (cgi_variable("Commit")) {
@@ -648 +733 @@
         }
 
+output_page:
         printf("<form name=\"swatform\" method=post action=wizard_params>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
         if (have_write_access) {
@@ -684 +771 @@
         int HomeExpo = 0;
         int SerType = 0;
+        const char form_name[] = "wizard";
+
+        if (!verify_xsrf_token(form_name)) {
+                goto output_page;
+        }
 
         if (cgi_variable("Rewrite")) {
@@ -774 +866 @@
 
         role = lp_server_role();
-        
+
+output_page:
         /* Here we go ... */
         printf("<H2>%s</H2>\n", _("Samba Configuration Wizard"));
         printf("<form method=post action=wizard>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
         if (have_write_access) {
@@ -846 +940 @@
         unsigned int parm_filter = FLAG_BASIC;
         int mode = 0;
+        const char form_name[] = "globals";
 
         printf("<H2>%s</H2>\n", _("Global Parameters"));
+
+        if (!verify_xsrf_token(form_name)) {
+                goto output_page;
+        }
 
         if (cgi_variable("Commit")) {
@@ -861 +960 @@
                 mode = 1;
 
+output_page:
         printf("<form name=\"swatform\" method=post action=globals>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
         ViewModeBoxes( mode );
@@ -901 +1002 @@
         unsigned int parm_filter = FLAG_BASIC;
         size_t converted_size;
+        const char form_name[] = "shares";
+
+        printf("<H2>%s</H2>\n", _("Share Parameters"));
+
+        if (!verify_xsrf_token(form_name)) {
+                goto output_page;
+        }
 
         if (share)
                 snum = lp_servicenumber(share);
 
-        printf("<H2>%s</H2>\n", _("Share Parameters"));
 
         if (cgi_variable("Commit") && snum >= 0) {
@@ -931 +1038 @@
         }
 
-        printf("<FORM name=\"swatform\" method=post>\n");
-
-        printf("<table>\n");
-
         if ( cgi_variable("ViewMode") )
                 mode = atoi(cgi_variable_nonull("ViewMode"));
@@ -941 +1044 @@
         if ( cgi_variable("AdvMode"))
                 mode = 1;
+
+output_page:
+        printf("<FORM name=\"swatform\" method=post>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
+        printf("<table>\n");
 
         ViewModeBoxes( mode );
@@ -1121 +1230 @@
                 printf("<p>");
                 if (rslt == True) {
-                        printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
-                        printf("\n");
+                        printf("%s\n", _(" The passwd has been changed."));
                 } else {
-                        printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
-                        printf("\n");
+                        printf("%s\n", _(" The passwd has NOT been changed."));
                 }
         }
@@ -1138 +1245 @@
 {
         const char *new_name = cgi_user_name();
-
-        /* 
-         * After the first time through here be nice. If the user
-         * changed the User box text to another users name, remember it.
-         */
-        if (cgi_variable(SWAT_USER)) {
-                new_name = cgi_variable_nonull(SWAT_USER);
-        } 
+        const char passwd_form[] = "passwd";
+        const char rpasswd_form[] = "rpasswd";
 
         if (!new_name) new_name = "";
@@ -1152 +1253 @@
 
         printf("<FORM name=\"swatform\" method=post>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), passwd_form);
 
         printf("<table>\n");
@@ -1191 +1293 @@
          * requested. It could be this is the first time through this
          * code, so there isn't anything to do.  */
-        if ((cgi_variable(CHG_S_PASSWD_FLAG)) || (cgi_variable(ADD_USER_FLAG)) || (cgi_variable(DELETE_USER_FLAG)) ||
-            (cgi_variable(DISABLE_USER_FLAG)) || (cgi_variable(ENABLE_USER_FLAG))) {
+        if (verify_xsrf_token(passwd_form) &&
+           ((cgi_variable(CHG_S_PASSWD_FLAG)) || (cgi_variable(ADD_USER_FLAG)) || (cgi_variable(DELETE_USER_FLAG)) ||
+            (cgi_variable(DISABLE_USER_FLAG)) || (cgi_variable(ENABLE_USER_FLAG)))) {
                 chg_passwd();           
         }
@@ -1199 +1302 @@
 
         printf("<FORM name=\"swatform\" method=post>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), rpasswd_form);
 
         printf("<table>\n");
@@ -1231 +1335 @@
          * is the first time through this code, so there isn't
          * anything to do.  */
-        if (cgi_variable(CHG_R_PASSWD_FLAG)) {
+        if (verify_xsrf_token(passwd_form) && cgi_variable(CHG_R_PASSWD_FLAG)) {
                 chg_passwd();           
         }
@@ -1248 +1352 @@
         int mode = 0;
         unsigned int parm_filter = FLAG_BASIC;
+        const char form_name[] = "printers";
+
+        if (!verify_xsrf_token(form_name)) {
+                goto output_page;
+        }
 
         if (share)
                 snum = lp_servicenumber(share);
-
-        printf("<H2>%s</H2>\n", _("Printer Parameters"));
- 
-        printf("<H3>%s</H3>\n", _("Important Note:"));
-        printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
-        printf("%s",_("are autoloaded printers from "));
-        printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
-        printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
 
         if (cgi_variable("Commit") && snum >= 0) {
@@ -1288 +1389 @@
         }
 
-        printf("<FORM name=\"swatform\" method=post>\n");
-
         if ( cgi_variable("ViewMode") )
                 mode = atoi(cgi_variable_nonull("ViewMode"));
@@ -1296 +1395 @@
         if ( cgi_variable("AdvMode"))
                 mode = 1;
+
+output_page:
+        printf("<H2>%s</H2>\n", _("Printer Parameters"));
+
+        printf("<H3>%s</H3>\n", _("Important Note:"));
+        printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
+        printf("%s",_("are autoloaded printers from "));
+        printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
+        printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
+
+
+        printf("<FORM name=\"swatform\" method=post>\n");
+        print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
         ViewModeBoxes( mode );