#4050 CSRF tokens improvements

grid.php

@@ -32,7 +32,12 @@ if(method_exists($oGrid, 'init'))
 
 $sAction = 'performAction' . bx_gen_method_name(bx_process_input(bx_get('a')));
 if (method_exists($oGrid, $sAction)) {
-    $oGrid->$sAction();
+    if (BxDolForm::isCsrfTokenValid(bx_get('csrf_token'), false)) {
+        $oGrid->$sAction();
+    }
+    else {
+        echoJson(['msg' => _t('_sys_txt_form_submission_error_csrf_expired'), 'grid' => $oGrid->getCode(false)]);
+    }
 }
 
 /** @} */

inc/classes/BxDolForm.php

@@ -1112,7 +1112,7 @@ class BxDolForm extends BxDol implements iBxDolReplaceable
         return $oKeys->getNewKey (false, (int)getParam('sys_security_form_token_lifetime'), BxDolSession::getInstance()->getId());
     }
     
-    public static function isCsrfTokenValid($s)
+    public static function isCsrfTokenValid($s, $bDeleteToken = true)
     {
         if (getParam('sys_security_form_token_enable') != 'on')
             return true;
@@ -1122,7 +1122,8 @@ class BxDolForm extends BxDol implements iBxDolReplaceable
 
         if ($oKeys->isKeyExists($s)) {
             $bRet = $oKeys->isKeyExists($s, BxDolSession::getInstance()->getId());
-            $oKeys->removeKey($s);
+            if ($bDeleteToken)
+                $oKeys->removeKey($s);
             return $bRet;
         }
         return false;

inc/js/classes/BxDolGrid.js

@@ -14,6 +14,8 @@ function BxDolGrid (sObject, oOptions) {
     this._sIdTable = 'bx-grid-table-' + sObject;
     this._oOptions = oOptions;
     
+    this._sCsrfToken = oOptions.csrf_token;
+
     this._sOrderField = undefined == oOptions.order_field ? '' : oOptions.order_field;
     this._sOrderDir = undefined == oOptions.order_dir ? 'ASC' : oOptions.order_dir;
     this._sSearchInputText = undefined == oOptions.text_search_input ? '' : oOptions.text_search_input;
@@ -217,6 +219,8 @@ BxDolGrid.prototype.action = function (sAction, oData, sData, isDisableLoading,
             sUrl += '&' + $this._oOptions.order_get_field + '=' + encodeURIComponent ($this._sOrderField);
         if ($this._sOrderDir.length)
             sUrl += '&' + $this._oOptions.order_get_dir + '=' + encodeURIComponent ($this._sOrderDir);
+        if ($this._sCsrfToken.length)
+            sUrl += '&csrf_token=' + encodeURIComponent ($this._sCsrfToken);
         sUrl += '&_r=' + Math.random();
 
         if (typeof(isDisableLoading) == 'undefined' || !isDisableLoading)

template/grid.html

@@ -72,6 +72,7 @@
             glGrids = {};
         if (undefined == glGrids.__object__) {
             glGrids.__object__ = new BxDolGrid('__object__', {
+                csrf_token: '__csrf_token__',
                 sortable: __sortable__,
                 sorting: __sorting__,
                 paginate_get_start: '__paginate_get_start__',

template/scripts/BxBaseGrid.php

@@ -211,6 +211,7 @@ class BxBaseGrid extends BxDolGrid
 
         $aVars = array (
             'object' => $this->_sObject,
+            'csrf_token' => BxDolForm::getCsrfToken(),
             'id_table' => $sIdTable,
             'id_cont' => $sIdContainer,
             'id_wrap' => $sIdWrapper,