diff --git a/include/class.csrf.php b/include/class.csrf.php index 94f103cb8277013ef4131035968cb0775487b6eb..a1c3aed21392d5932b6b1edb31108cc6d3bedf8a 100644 --- a/include/class.csrf.php +++ b/include/class.csrf.php @@ -53,12 +53,15 @@ Class CSRF { return $this->name; } - function getToken() { + function rotate() { + $this->csrf['token'] = sha1(session_id().Crypto::random(16).SECRET_SALT); + $this->csrf['time'] = time(); + } - if(!$this->csrf['token'] || $this->isExpired()) { + function getToken() { - $this->csrf['token'] = sha1(session_id().Crypto::random(16).SECRET_SALT); - $this->csrf['time'] = time(); + if (!$this->csrf['token'] || $this->isExpired()) { + $this->rotate(); } else { //Reset the timer $this->csrf['time'] = time(); diff --git a/login.php b/login.php index f79bf8563320f672fdb90c67fff9e178eafd4fd7..a90376ec3ee40072ee0290f4bfaa51b44f95b170 100644 --- a/login.php +++ b/login.php @@ -31,6 +31,20 @@ else $inc = 'login.inc.php'; $suggest_pwreset = false; + +// Check the CSRF token, and ensure that future requests will have to use a +// different CSRF token. This will help ward off both parallel and serial +// brute force attacks, because new tokens will have to be requested for +// each attempt. +if ($_POST) { + // Check CSRF token + if (!$ost->checkCSRFToken()) + Http::response(400, __('Valid CSRF Token Required')); + + // Rotate the CSRF token (original cannot be reused) + $ost->getCSRF()->rotate(); +} + if ($_POST && isset($_POST['luser'])) { if (!$_POST['luser']) $errors['err'] = __('Valid username or email address is required'); diff --git a/scp/login.php b/scp/login.php index ad07a831b9d329c5044339fb08b5b726b178baa9..bbf8dc7a31c5f156dd7c81718858689aecf91839 100644 --- a/scp/login.php +++ b/scp/login.php @@ -31,6 +31,16 @@ $msg = $msg ?: ($content ? $content->getName() : __('Authentication Required')); $dest=($dest && (!strstr($dest,'login.php') && !strstr($dest,'ajax.php')))?$dest:'index.php'; $show_reset = false; if($_POST) { + // Check the CSRF token, and ensure that future requests will have to + // use a different CSRF token. This will help ward off both parallel and + // serial brute force attacks, because new tokens will have to be + // requested for each attempt. + if (!$ost->checkCSRFToken()) + Http::response(400, __('Valid CSRF Token Required')); + + // Rotate the CSRF token (original cannot be reused) + $ost->getCSRF()->rotate(); + // Lookup support backends for this staff $username = trim($_POST['userid']); if ($user = StaffAuthenticationBackend::process($username,