Skip to content

Commit 3647159

Browse files
bradymillerbradymiller
authored
More csrf improvements (openemr#2509)
1. converted to class 2. truncate token to length 40
1 parent 9d9363d commit 3647159

File tree

336 files changed

+1681
-1146
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

336 files changed

+1681
-1146
lines changed

‎apis/dispatch.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@
7171
require_once("./../interface/globals.php");
7272
require_once("./../library/acl.inc");
7373

74+
use OpenEMR\Common\Csrf\CsrfUtils;
75+
7476
if ($isLocalApi) {
7577
// need to check for csrf match when using api locally
7678
$csrfFail = false;
@@ -80,7 +82,7 @@
8082
$csrfFail = true;
8183
}
8284

83-
if ((!$csrfFail) && (!verifyCsrfToken($_SERVER['HTTP_APICSRFTOKEN'], 'api'))) {
85+
if ((!$csrfFail) && (!CsrfUtils::verifyCsrfToken($_SERVER['HTTP_APICSRFTOKEN'], 'api'))) {
8486
error_log("OpenEMR Error: internal api failed because csrf token did not match");
8587
$csrfFail = true;
8688
}

‎contrib/forms/assessment_intake/new.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,17 @@
1212

1313
require_once("../../globals.php");
1414
require_once("$srcdir/api.inc");
15+
16+
use OpenEMR\Common\Csrf\CsrfUtils;
17+
1518
formHeader("Form: assessment_intake");
1619
?>
1720
<html><head>
1821
<link rel=stylesheet href="<?php echo $css_header;?>" type="text/css">
1922
</head>
2023
<body <?php echo $top_bg_line;?> topmargin=0 rightmargin=0 leftmargin=2 bottommargin=0 marginwidth=2 marginheight=0>
2124
<form method=post action="<?php echo $rootdir;?>/forms/assessment_intake/save.php?mode=new" name="my_form">
22-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
25+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
2326
<br>
2427
<span class="title"><center>Assessment and Intake</center></span><br><br>
2528
<center><a href="javascript:top.restoreSession();document.my_form.submit();" class="link_submit">[Save]</a>

‎contrib/forms/assessment_intake/save.php

+4-2
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,11 @@
1414
require_once("$srcdir/api.inc");
1515
require_once("$srcdir/forms.inc");
1616

17+
use OpenEMR\Common\Csrf\CsrfUtils;
18+
1719
if (!empty($_POST)) {
18-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
19-
csrfNotVerified();
20+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
21+
CsrfUtils::csrfNotVerified();
2022
}
2123
}
2224

‎contrib/forms/assessment_intake/view.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@
2121
?>
2222
<?php
2323
require_once("../../globals.php");
24+
25+
use OpenEMR\Common\Csrf\CsrfUtils;
26+
2427
?>
2528
<html><head>
2629
<link rel=stylesheet href="<?php echo $css_header;?>" type="text/css">
@@ -33,7 +36,7 @@
3336

3437
?>
3538
<form method=post action="<?php echo $rootdir?>/forms/assessment_intake/save.php?mode=update&id=<?php echo attr_url($_GET["id"]);?>" name="my_form">
36-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
39+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
3740

3841
<span class="title"><center><b>Assessment and Intake</b></center></span><br><br>
3942

‎contrib/forms/body_composition/new.php

+5-3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
require_once("$srcdir/api.inc");
1919
require_once("$srcdir/forms.inc");
2020

21+
use OpenEMR\Common\Csrf\CsrfUtils;
22+
2123
$scale_file_name = '/tmp/tanita_scale.txt';
2224
$scale_file_age = -1;
2325
$row = array();
@@ -52,8 +54,8 @@ function rbinput($name, $value, $desc, $colname)
5254
// If Save was clicked, save the info.
5355
//
5456
if ($_POST['bn_save']) {
55-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
56-
csrfNotVerified();
57+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
58+
CsrfUtils::csrfNotVerified();
5759
}
5860

5961
// If updating an existing form...
@@ -115,7 +117,7 @@ function rbinput($name, $value, $desc, $colname)
115117
<body <?php echo $top_bg_line;?> topmargin="0" rightmargin="0" leftmargin="2" bottommargin="0" marginwidth="2" marginheight="0">
116118
<form method="post" action="<?php echo $rootdir ?>/forms/body_composition/new.php?id=<?php echo attr_url($formid) ?>"
117119
onsubmit="return top.restoreSession()">
118-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
120+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
119121

120122
<center>
121123

‎contrib/forms/body_composition/view.php

+5-3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
require_once("$srcdir/api.inc");
1818
require_once("$srcdir/forms.inc");
1919

20+
use OpenEMR\Common\Csrf\CsrfUtils;
21+
2022
$scale_file_name = '/tmp/tanita_scale.txt';
2123
$scale_file_age = -1;
2224
$row = array();
@@ -52,8 +54,8 @@ function rbinput($name, $value, $desc, $colname)
5254
// If Save was clicked, save the info.
5355
//
5456
if ($_POST['bn_save']) {
55-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
56-
csrfNotVerified();
57+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
58+
CsrfUtils::csrfNotVerified();
5759
}
5860

5961
// If updating an existing form...
@@ -118,7 +120,7 @@ function rbinput($name, $value, $desc, $colname)
118120
<body <?php echo $top_bg_line; ?> topmargin="0" rightmargin="0" leftmargin="2" bottommargin="0" marginwidth="2" marginheight="0">
119121
<form method="post" action="<?php echo $rootdir ?>/forms/body_composition/new.php?id=<?php echo attr_url($formid) ?>"
120122
onsubmit="return top.restoreSession()">
121-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
123+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
122124

123125
<center>
124126

‎contrib/forms/clinical_notes/new.php

+5-3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
require_once("$srcdir/api.inc");
1919
require_once("$srcdir/forms.inc");
2020

21+
use OpenEMR\Common\Csrf\CsrfUtils;
22+
2123
$row = array();
2224

2325
if (! $encounter) { // comes from globals.php
@@ -79,8 +81,8 @@ function cbcell($name, $desc, $colname)
7981
//
8082
if ($_POST['bn_save']) {
8183
$fu_timing = $_POST['fu_timing'];
82-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
83-
csrfNotVerified();
84+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
85+
CsrfUtils::csrfNotVerified();
8486
}
8587

8688
// If updating an existing form...
@@ -127,7 +129,7 @@ function cbcell($name, $desc, $colname)
127129
bottommargin="0" marginwidth="2" marginheight="0">
128130
<form method="post" action="<?php echo $rootdir ?>/forms/clinical_notes/new.php?id=<?php echo attr_url($formid) ?>"
129131
onsubmit="return top.restoreSession()">
130-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
132+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
131133

132134
<center>
133135

‎contrib/forms/clinical_notes/view.php

+5-3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
require_once("$srcdir/api.inc");
1919
require_once("$srcdir/forms.inc");
2020

21+
use OpenEMR\Common\Csrf\CsrfUtils;
22+
2123
$row = array();
2224

2325
if (! $encounter) { // comes from globals.php
@@ -79,8 +81,8 @@ function cbcell($name, $desc, $colname)
7981
//
8082
if ($_POST['bn_save']) {
8183
$fu_timing = $_POST['fu_timing'];
82-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
83-
csrfNotVerified();
84+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
85+
CsrfUtils::csrfNotVerified();
8486
}
8587

8688
// If updating an existing form...
@@ -126,7 +128,7 @@ function cbcell($name, $desc, $colname)
126128
bottommargin="0" marginwidth="2" marginheight="0">
127129
<form method="post" action="<?php echo $rootdir ?>/forms/clinical_notes/new.php?id=<?php echo attr_url($formid); ?>"
128130
onsubmit="return top.restoreSession()">
129-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
131+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
130132

131133
<center>
132134

‎contrib/forms/contacts/new.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,17 @@
2323
<?php
2424
require_once("../../globals.php");
2525
require_once("$srcdir/api.inc");
26+
27+
use OpenEMR\Common\Csrf\CsrfUtils;
28+
2629
formHeader("Form: contacts");
2730
?>
2831
<html><head>
2932
<link rel=stylesheet href="<?php echo $css_header;?>" type="text/css">
3033
</head>
3134
<body <?php echo $top_bg_line;?> topmargin=0 rightmargin=0 leftmargin=2 bottommargin=0 marginwidth=2 marginheight=0>
3235
<form method=post action="<?php echo $rootdir;?>/forms/contacts/save.php?mode=new" name="my_form">
33-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
36+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
3437
<span class="title">Contacts</span><br><br>
3538
<table>
3639
<tr>

‎contrib/forms/contacts/save.php

+4-2
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@
1818
require_once("$srcdir/api.inc");
1919
require_once("$srcdir/forms.inc");
2020

21-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
22-
csrfNotVerified();
21+
use OpenEMR\Common\Csrf\CsrfUtils;
22+
23+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
24+
CsrfUtils::csrfNotVerified();
2325
}
2426

2527
if ($encounter == "") {

‎contrib/forms/contacts/view.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@
2222
<!-- Forms generated from formsWiz -->
2323
<?php
2424
require_once("../../globals.php");
25+
26+
use OpenEMR\Common\Csrf\CsrfUtils;
27+
2528
?>
2629
<html><head>
2730
<link rel=stylesheet href="<?php echo $css_header;?>" type="text/css">
@@ -32,7 +35,7 @@
3235
$obj = formFetch("form_contacts", $_GET["id"]);
3336
?>
3437
<form method=post action="<?php echo $rootdir?>/forms/contacts/save.php?mode=update&id=<?php echo attr_url($_GET["id"]); ?>" name="my_form">
35-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
38+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
3639
<span class="title">Contacts</span><Br><br>
3740
<table>
3841
<tr>

‎contrib/forms/evaluation/C_FormEvaluation.class.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
require_once("FormEvaluation.class.php");
1616

1717
use OpenEMR\Billing\BillingUtilities;
18+
use OpenEMR\Common\Csrf\CsrfUtils;
1819

1920
class C_FormEvaluation extends Controller
2021
{
@@ -29,7 +30,7 @@ function __construct($template_mod = "general")
2930
$this->assign("FORM_ACTION", $GLOBALS['web_root']);
3031
$this->assign("DONT_SAVE_LINK", $GLOBALS['form_exit_url']);
3132
$this->assign("STYLE", $GLOBALS['style']);
32-
$this->assign("CSRF_TOKEN_FORM", collectCsrfToken());
33+
$this->assign("CSRF_TOKEN_FORM", CsrfUtils::collectCsrfToken());
3334
}
3435

3536
function default_action()

‎contrib/forms/evaluation/save.php

+4-2
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@
1313
require_once("$srcdir/api.inc");
1414
require("C_FormEvaluation.class.php");
1515

16-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
17-
csrfNotVerified();
16+
use OpenEMR\Common\Csrf\CsrfUtils;
17+
18+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
19+
CsrfUtils::csrfNotVerified();
1820
}
1921

2022
$c = new C_FormEvaluation();

‎contrib/forms/example2/new.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
require_once("../../globals.php");
1414
require_once("$srcdir/api.inc");
1515

16+
use OpenEMR\Common\Csrf\CsrfUtils;
17+
1618
/** CHANGE THIS name to the name of your form **/
1719
$form_name = "My Example Form";
1820

@@ -43,7 +45,7 @@
4345
<?php echo date("F d, Y", time()); ?>
4446

4547
<form method=post action="<?php echo $rootdir;?>/forms/<?php echo $form_folder; ?>/save.php?mode=new" name="my_form">
46-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
48+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
4749

4850
<span class="title"><?php echo xlt($form_name); ?></span><br>
4951

‎contrib/forms/example2/print.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
require_once("../../globals.php");
1616
require_once("$srcdir/api.inc");
1717

18+
use OpenEMR\Common\Csrf\CsrfUtils;
19+
1820
/** CHANGE THIS - name of the database table associated with this form **/
1921
$table_name = "form_example";
2022

@@ -64,7 +66,7 @@
6466
Printed on <?php echo date("F d, Y", time()); ?>
6567

6668
<form method=post action="">
67-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
69+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
6870

6971
<span class="title"><?php echo xlt($form_name); ?></span><br>
7072

‎contrib/forms/example2/save.php

+4-2
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@
1717
require_once("$srcdir/api.inc");
1818
require_once("$srcdir/forms.inc");
1919

20-
if (!verifyCsrfToken($_POST["csrf_token_form"])) {
21-
csrfNotVerified();
20+
use OpenEMR\Common\Csrf\CsrfUtils;
21+
22+
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
23+
CsrfUtils::csrfNotVerified();
2224
}
2325

2426
/** CHANGE THIS - name of the database table associated with this form **/

‎contrib/forms/example2/view.php

+3-1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
require_once("../../globals.php");
1515
require_once("$srcdir/api.inc");
1616

17+
use OpenEMR\Common\Csrf\CsrfUtils;
18+
1719
/** CHANGE THIS - name of the database table associated with this form **/
1820
$table_name = "form_example";
1921

@@ -71,7 +73,7 @@ function PrintForm() {
7173
<?php echo date("F d, Y", time()); ?>
7274

7375
<form method=post action="<?php echo $rootdir;?>/forms/<?php echo $form_folder; ?>/save.php?mode=update&id=<?php echo attr_url($_GET["id"]);?>" name="my_form">
74-
<input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
76+
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
7577

7678
<span class="title"><?php echo xlt($form_name); ?></span><br>
7779

0 commit comments

Comments
 (0)