Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Fixed minor, but annoying CSRF vulnerability with the logout function. |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA1: |
42032b0a862fccd3cacae1caeb175d58 |
| User & Date: | johnfound 2018-11-21 09:11:07 |
Context
|
2018-11-21
| ||
| 09:50:43 | Binary pack updated. check-in: 7bb3292ed4 user: johnfound tags: trunk | |
| 09:11:07 | Fixed minor, but annoying CSRF vulnerability with the logout function. check-in: 42032b0a86 user: johnfound tags: trunk | |
|
2018-11-20
| ||
| 20:50:20 | Binary pack updated with the latest version of the bot protection. Notice, that the skins are updated as well. check-in: 943c49adf9 user: johnfound tags: trunk | |
Changes
Changes to source/ToDo.txt.
1 2 3 4 5 6 7 8 | ---FIXED: To check the skins (especially Terminal) for the new implemented features: download/attach, access, etc. ---FIXED: The tabbed edit form not working good in Light skin. Another are not tested as well. ---FIXED: The tabbed edit is not styling properly in Chromium! Check the tricks about flex auto scaling! On logout, all sessions for this IP are deleted. Should be more relaxed... | | | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | ---FIXED: To check the skins (especially Terminal) for the new implemented features: download/attach, access, etc. ---FIXED: The tabbed edit form not working good in Light skin. Another are not tested as well. ---FIXED: The tabbed edit is not styling properly in Chromium! Check the tricks about flex auto scaling! On logout, all sessions for this IP are deleted. Should be more relaxed... ---DONE: The attached files must be encrypted in the database in order to not allow them to the file system in original form. The tabs still working weird, because the absolute positioning. ---DONE: The permLogin for the anon users to work as permRegister in order to allow the forum to close the registration. |
| ︙ | ︙ |
Changes to source/accounts.asm.
| ︙ | ︙ | |||
335 336 337 338 339 340 341 342 343 344 345 |
sqlLogout text "delete from Sessions where userID = ?"
proc UserLogout, .pspecial
.stmt dd ?
begin
pushad
stdcall TextCreate, sizeof.TText
mov edi, eax
| > > > > > > > < | 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 |
sqlLogout text "delete from Sessions where userID = ?"
proc UserLogout, .pspecial
.stmt dd ?
begin
pushad
mov esi, [.pspecial]
OutputValue "Logout POST parameters: ", [esi+TSpecialParams.post_array], 16, 8
cmp [esi+TSpecialParams.post_array], 0 ; this function must be invoked only by POST request!
je .error_trick
stdcall TextCreate, sizeof.TText
mov edi, eax
stdcall LogUserActivity, esi, uaLoggingOut, 0
cmp [esi+TSpecialParams.session], 0
je .finish
lea eax, [.stmt]
cinvoke sqlitePrepare_v2, [hMainDatabase], sqlLogout, -1, eax, 0
|
| ︙ | ︙ | |||
367 368 369 370 371 372 373 374 375 376 377 378 379 380 |
stdcall TextMakeRedirect, edi, eax
stdcall StrDel ; from the stack
mov [esp+4*regEAX], edi
stc
popad
return
endp
| > > > > > > > > | 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 |
stdcall TextMakeRedirect, edi, eax
stdcall StrDel ; from the stack
mov [esp+4*regEAX], edi
stc
popad
return
.error_trick:
xor eax, eax
mov [esp+4*regEAX], eax
clc
popad
return
endp
|
| ︙ | ︙ |
Changes to www/templates/Terminal/common.less.
| ︙ | ︙ | |||
38 39 40 41 42 43 44 45 46 47 48 49 50 51 |
background-color: lime;
cursor: col-resize;
}
a {
color: @clHighlight;
}
.clear {
clear: both;
}
.flex {
display: flex;
| > > > > > > > > | 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
background-color: lime;
cursor: col-resize;
}
a {
color: @clHighlight;
}
.logout {
border: none;
background-color: transparent;
color: @clHighlight;
text-decoration: underline;
cursor: pointer;
}
.clear {
clear: both;
}
.flex {
display: flex;
|
| ︙ | ︙ |
Changes to www/templates/Terminal/main_html_start.tpl.
| ︙ | ︙ | |||
58 59 60 61 62 63 64 |
█▄▄█░█▄▄▄░█░█░█░█▀▀▄░█▀▀▄
█░░█░▄▄▄█░█░█░█░█▄▄▀░█▄▄▀
------->
<div class="header">
<div id="userlinks">
[case:[special:userid]|<a href="/!login/">Login</a>[case:[special:canregister]||<br><a href="/!register/">Register</a>]|
| | > | 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
█▄▄█░█▄▄▄░█░█░█░█▀▀▄░█▀▀▄
█░░█░▄▄▄█░█░█░█░█▄▄▀░█▄▄▀
------->
<div class="header">
<div id="userlinks">
[case:[special:userid]|<a href="/!login/">Login</a>[case:[special:canregister]||<br><a href="/!register/">Register</a>]|
<form method="POST" action="/!logout"><input class="logout" name="logout" type="submit" value="Logout ([special:username])"></form><a href="/!userinfo/[special:username]">User profile</a>
]
</div>
<form id="skinform" method="POST" action="/!skincookie">
<select class="skin" name="skin" onchange="this.form.submit()">
<option value="0">(Default)</option>
[special:skins=[special:skincookie]]
</select>
<noscript style="display: inline; margin-left: 0px">
|
| ︙ | ︙ |
Changes to www/templates/Wasp/common.less.
| ︙ | ︙ | |||
59 60 61 62 63 64 65 |
color: @clHeader;
}
div {
text-align: right;
margin-left: 16px;
| | > > > > | 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 |
color: @clHeader;
}
div {
text-align: right;
margin-left: 16px;
a, .logout {
background-color: transparent;
border: none;
font-weight: bold;
text-align: right;
display: inline;
line-height: 1.5em;
text-shadow: 2px 2px @clColor1, -2px -2px @clColor1, 2px -2px @clColor1, -2px 2px @clColor1;
text-decoration: underline;
cursor: pointer;
}
}
}
// This is a class that separate left-aligned and right-aligned items in a flexbox.
.spacer {
flex-grow: 1;
|
| ︙ | ︙ |
Changes to www/templates/Wasp/main_html_start.tpl.
| ︙ | ︙ | |||
44 45 46 47 48 49 50 |
<noscript style="display: inline; margin-left: 0px">
<input type="submit" value="Go">
</noscript>
</form>
</div>
<div>
[case:[special:userid]|<a href="/!login/">Login</a><br>[case:[special:canregister]||<a href="/!register/">Register</a>]|
| | > | 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
<noscript style="display: inline; margin-left: 0px">
<input type="submit" value="Go">
</noscript>
</form>
</div>
<div>
[case:[special:userid]|<a href="/!login/">Login</a><br>[case:[special:canregister]||<a href="/!register/">Register</a>]|
<form method="POST" action="/!logout"><input class="logout" type="submit" name="logout" value="Logout ([special:username])"></form><a href="/!userinfo/[special:username]">User profile</a>
]
</div>
</div>
<form class="tags" id="search_form" action="[case:[special:cmdtype]||/|../]!search/" method="get" >
<input class="search_line" type="search" name="s" placeholder="text search" value="[special:search]">
<input class="search_line" type="search" name="u" placeholder="user search" value="[special:usearch]">
<a class="icon_btn"><input class="img_input" type="image" width="32" height="32" src="[special:skin]/_images/search.svg" alt=" Search " title="Search"></a>
|
| ︙ | ︙ |