Improve CSRF tokens and add to more forms.

1 files changed, 37 insertions, 3 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Auth.pm b/perllib/FixMyStreet/App/Controller/Auth.pm
index 203479253..65533b1d2 100644
--- a/perllib/FixMyStreet/App/Controller/Auth.pm
+++ b/perllib/FixMyStreet/App/Controller/Auth.pm
@@ -6,8 +6,9 @@ BEGIN { extends 'Catalyst::Controller'; }
 
 use Email::Valid;
 use Net::Domain::TLD;
-use mySociety::AuthToken;
+use Digest::HMAC_SHA1 qw(hmac_sha1);
 use JSON::MaybeXS;
+use MIME::Base64;
 use Net::Facebook::Oauth2;
 use Net::Twitter::Lite::WithAPIv1_1;
 
@@ -415,12 +416,13 @@ sub change_password : Local {
 
     $c->detach( 'redirect' ) unless $c->user;
 
-    # FIXME - CSRF check here
-    # FIXME - minimum criteria for passwords (length, contain number, etc)
+    $c->forward('get_csrf_token');
 
     # If not a post then no submission
     return unless $c->req->method eq 'POST';
 
+    $c->forward('check_csrf_token');
+
     # get the passwords
     my $new = $c->get_param('new_password') // '';
     my $confirm = $c->get_param('confirm') // '';
@@ -444,6 +446,38 @@ sub change_password : Local {
 
 }
 
+sub get_csrf_token : Private {
+    my ( $self, $c ) = @_;
+
+    my $time = $c->stash->{csrf_time} || time();
+    my $hash = hmac_sha1("$time-" . ($c->sessionid || ""), $c->model('DB::Secret')->get);
+    $hash = encode_base64($hash, "");
+    $hash =~ s/=$//;
+    my $token = "$time-$hash";
+    $c->stash->{csrf_token} = $token unless $c->stash->{csrf_time};
+    return $token;
+}
+
+sub check_csrf_token : Private {
+    my ( $self, $c ) = @_;
+
+    my $token = $c->get_param('token') || "";
+    $token =~ s/ /+/g;
+    my ($time) = $token =~ /^(\d+)-[0-9a-zA-Z+\/]+$/;
+    $c->stash->{csrf_time} = $time;
+    $c->detach('no_csrf_token')
+        unless $time
+            && $time > time() - 3600
+            && $token eq $c->forward('get_csrf_token');
+    delete $c->stash->{csrf_time};
+}
+
+sub no_csrf_token : Private {
+    my ($self, $c) = @_;
+    $c->stash->{message} = _('Unknown error');
+    $c->stash->{template} = 'errors/generic.html';
+}
+
 =head2 sign_out
 
 Log the user out. Tell them we've done so.