Skip to content

Commit ca2e7a5

Browse files
AngelFQCAngelFQC
committed
Security: Refactor cookie warning to avoid CSRF - refs BT#21289
1 parent f2df5d3 commit ca2e7a5

File tree

6 files changed

+50
-50
lines changed

6 files changed

+50
-50
lines changed

‎index.php

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -126,15 +126,13 @@
126126
$useCookieValidation = api_get_setting('cookie_warning');
127127

128128
if ($useCookieValidation === 'true') {
129-
if (isset($_POST['acceptCookies'])) {
130-
api_set_site_use_cookie_warning_cookie();
131-
} elseif (!api_site_use_cookie_warning_cookie_exist()) {
129+
if (!api_site_use_cookie_warning_cookie_exist()) {
132130
if (Template::isToolBarDisplayedForUser()) {
133131
$controller->tpl->assign('toolBarDisplayed', true);
134132
} else {
135133
$controller->tpl->assign('toolBarDisplayed', false);
136134
}
137-
$controller->tpl->assign('displayCookieUsageWarning', true);
135+
$controller->tpl->enableCookieUsageWarning();
138136
}
139137
}
140138
// When loading a chamilo page do not include the hot courses and news

‎main/admin/index.php

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1018,15 +1018,13 @@
10181018
// Display the Site Use Cookie Warning Validation
10191019
$useCookieValidation = api_get_setting('cookie_warning');
10201020
if ($useCookieValidation === 'true') {
1021-
if (isset($_POST['acceptCookies'])) {
1022-
api_set_site_use_cookie_warning_cookie();
1023-
} elseif (!api_site_use_cookie_warning_cookie_exist()) {
1021+
if (!api_site_use_cookie_warning_cookie_exist()) {
10241022
if (Template::isToolBarDisplayedForUser()) {
10251023
$tpl->assign('toolBarDisplayed', true);
10261024
} else {
10271025
$tpl->assign('toolBarDisplayed', false);
10281026
}
1029-
$tpl->assign('displayCookieUsageWarning', true);
1027+
$tpl->enableCookieUsageWarning();
10301028
}
10311029
}
10321030

‎main/inc/lib/template.lib.php

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1317,6 +1317,42 @@ public static function displayLoginForm()
13171317
return $html;
13181318
}
13191319

1320+
public function enableCookieUsageWarning()
1321+
{
1322+
$form = new FormValidator(
1323+
'cookiewarning',
1324+
'post',
1325+
'',
1326+
'',
1327+
[
1328+
//'onsubmit' => "$(this).toggle('show')",
1329+
],
1330+
FormValidator::LAYOUT_BOX_NO_LABEL
1331+
);
1332+
$form->addHidden('acceptCookies', '1');
1333+
$form->addHtml(
1334+
'<div class="cookieUsageValidation">
1335+
'.get_lang('YouAcceptCookies').'
1336+
<button class="btn btn-link" onclick="$(this).next().toggle(\'slow\'); $(this).toggle(\'slow\')" type="button">
1337+
('.get_lang('More').')
1338+
</button>
1339+
<div style="display:none; margin:20px 0;">
1340+
'.get_lang('HelpCookieUsageValidation').'
1341+
</div>
1342+
<button class="btn btn-link" onclick="$(this).parents(\'form\').submit()" type="button">
1343+
('.get_lang('Accept').')
1344+
</button>
1345+
</div>'
1346+
);
1347+
1348+
if ($form->validate()) {
1349+
api_set_site_use_cookie_warning_cookie();
1350+
} else {
1351+
$form->protect();
1352+
$this->assign('frmDisplayCookieUsageWarning', $form->returnForm());
1353+
}
1354+
}
1355+
13201356
/**
13211357
* Returns the tutors names for the current course in session
13221358
* Function to use in Twig templates.

‎main/template/default/layout/page.tpl

Lines changed: 2 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,24 +14,10 @@
1414
<main id="main" dir="{{ text_direction }}" class="{{ section_name }} {{ login_class }}">
1515
<noscript>{{ "NoJavascript"|get_lang }}</noscript>
1616

17-
{% if displayCookieUsageWarning == true %}
17+
{% if frmDisplayCookieUsageWarning %}
1818
<!-- START DISPLAY COOKIES VALIDATION -->
1919
<div class="toolbar-cookie alert-warning">
20-
<form onSubmit="$(this).toggle('slow')" action="" method="post">
21-
<input value=1 type="hidden" name="acceptCookies"/>
22-
<div class="cookieUsageValidation">
23-
{{ 'YouAcceptCookies' | get_lang }}
24-
<span style="margin-left:20px;" onclick="$(this).next().toggle('slow'); $(this).toggle('slow')">
25-
({{"More" | get_lang }})
26-
</span>
27-
<div style="display:none; margin:20px 0;">
28-
{{ "HelpCookieUsageValidation" | get_lang}}
29-
</div>
30-
<span style="margin-left:20px;" onclick="$(this).parent().parent().submit()">
31-
({{"Accept" | get_lang }})
32-
</span>
33-
</div>
34-
</form>
20+
{{ frmDisplayCookieUsageWarning }}
3521
</div>
3622
<!-- END DISPLAY COOKIES VALIDATION -->
3723
{% endif %}

‎main/template/default/layout/show_header.tpl

Lines changed: 2 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,24 +14,10 @@
1414
<!-- START MAIN -->
1515
<main id="main" dir="{{ text_direction }}" class="{{ section_name }} {{ login_class }}">
1616
<noscript>{{ "NoJavascript"|get_lang }}</noscript>
17-
{% if displayCookieUsageWarning == true %}
17+
{% if frmDisplayCookieUsageWarning %}
1818
<!-- START DISPLAY COOKIES VALIDATION -->
1919
<div class="toolbar-cookie alert-warning">
20-
<form onSubmit="$(this).toggle('slow')" action="" method="post">
21-
<input value=1 type="hidden" name="acceptCookies"/>
22-
<div class="cookieUsageValidation">
23-
{{ 'YouAcceptCookies' | get_lang }}
24-
<span style="margin-left:20px;" onclick="$(this).next().toggle('slow'); $(this).toggle('slow')">
25-
({{"More" | get_lang }})
26-
</span>
27-
<div style="display:none; margin:20px 0;">
28-
{{ "HelpCookieUsageValidation" | get_lang}}
29-
</div>
30-
<span style="margin-left:20px;" onclick="$(this).parent().parent().submit()">
31-
({{"Accept" | get_lang }})
32-
</span>
33-
</div>
34-
</form>
20+
{{ frmDisplayCookieUsageWarning }}
3521
</div>
3622
<!-- END DISPLAY COOKIES VALIDATION -->
3723
{% endif %}

‎user_portal.php

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -295,17 +295,13 @@ function changeMyCoursesView(inView) {
295295
// Display the Site Use Cookie Warning Validation
296296
$useCookieValidation = api_get_setting('cookie_warning');
297297
if ($useCookieValidation === 'true') {
298-
if (isset($_POST['acceptCookies'])) {
299-
api_set_site_use_cookie_warning_cookie();
300-
} else {
301-
if (!api_site_use_cookie_warning_cookie_exist()) {
302-
if (Template::isToolBarDisplayedForUser()) {
303-
$controller->tpl->assign('toolBarDisplayed', true);
304-
} else {
305-
$controller->tpl->assign('toolBarDisplayed', false);
306-
}
307-
$controller->tpl->assign('displayCookieUsageWarning', true);
298+
if (!api_site_use_cookie_warning_cookie_exist()) {
299+
if (Template::isToolBarDisplayedForUser()) {
300+
$controller->tpl->assign('toolBarDisplayed', true);
301+
} else {
302+
$controller->tpl->assign('toolBarDisplayed', false);
308303
}
304+
$controller->tpl->enableCookieUsageWarning();
309305
}
310306
}
311307

0 commit comments

Comments
 (0)