#776 Make Connect* modules working when CSRF checking is turned off

modules/base/connect/classes/BxBaseModConnectModule.php

@@ -285,6 +285,31 @@ class BxBaseModConnectModule extends BxBaseModGeneralModule
         header("Location:{$sUrl}", true, $iStatus);
         exit;
     }
+
+    protected function _genToken($bReturn = false)
+    {
+        $oSession = BxDolSession::getInstance();
+
+        $sPrefix = $this->getName();
+
+        $iCsrfTokenLifetime = 3600;
+        if ($oSession->getValue($sPrefix . '_token') === false || (time() - (int)$oSession->getValue($sPrefix . '_token_time') > $iCsrfTokenLifetime)) {
+            $sToken = genRndPwd(20, false);
+            $oSession->setValue($sPrefix . '_token', $sToken);
+            $oSession->setValue($sPrefix . '_token_time', time());
+        }
+        else {
+            $sToken = $oSession->getValue($sPrefix . '_token');
+        }
+
+        return $sToken;
+    }
+
+    protected function _getToken()
+    {
+        $oSession = BxDolSession::getInstance();
+        return $oSession->getValue($this->getName() . '_token');
+    }
 }
 
 /** @} */

modules/boonex/dolphin_connect/classes/BxDolConModule.php

@@ -40,7 +40,7 @@ class BxDolConModule extends BxBaseModConnectModule
                 'client_id' => $this->_oConfig->sApiID,
                 'redirect_uri' => $this->_oConfig->sPageHandle,
                 'scope' => $this->_oConfig->sScope,
-                'state' => $this->_genCsrfToken(),
+                'state' => $this->_genToken(),
             ));
             $this->_redirect($sUrl);
         }
@@ -50,8 +50,8 @@ class BxDolConModule extends BxBaseModConnectModule
     {
         require_once(BX_DIRECTORY_PATH_INC . 'design.inc.php');
 
-        // check CSRF token
-        if ($this->_getCsrfToken() != bx_get('state')) {
+        // check token
+        if ($this->_getToken() != bx_get('state')) {
             $this->_oTemplate->getPage(_t('_Error'), MsgBox(_t('_sys_connect_state_invalid')));
             return;
         }
@@ -141,33 +141,6 @@ class BxDolConModule extends BxBaseModConnectModule
             
         return $aProfileFields;
     }
-
-    protected function _genCsrfToken($bReturn = false)
-    {
-        if (getParam('sys_security_form_token_enable') != 'on' || defined('BX_DOL_CRON_EXECUTE'))
-            return false;
-
-        $oSession = BxDolSession::getInstance();
-
-        $iCsrfTokenLifetime = (int)$this->_oDb->getParam('sys_security_form_token_lifetime');
-        if ($oSession->getValue('bx_dolcon_csrf_token') === false || ($iCsrfTokenLifetime != 0 && time() - (int)$oSession->getValue('csrf_token_time') > $iCsrfTokenLifetime)) {
-            $sToken = genRndPwd(20, false);
-            $oSession->setValue('bx_dolcon_csrf_token', $sToken);
-            $oSession->setValue('bx_dolcon_csrf_token_time', time());
-        }
-        else {
-            $sToken = $oSession->getValue('bx_dolcon_csrf_token');
-        }
-
-        return $sToken;
-    }
-
-    protected function _getCsrfToken()
-    {
-        $oSession = BxDolSession::getInstance();
-        return $oSession->getValue('bx_dolcon_csrf_token');
-    }
-
 }
 
 /** @} */

modules/boonex/google_connect/classes/BxGoogleConModule.php

@@ -40,7 +40,7 @@ class BxGoogleConModule extends BxBaseModConnectModule
                 'client_id' => $this->_oConfig->sApiID,
                 'redirect_uri' => $this->_oConfig->sPageHandle,
                 'scope' => $this->_oConfig->sScope,
-                'state' => $this->_genCsrfToken(),
+                'state' => $this->_genToken(),
             ));
             $this->_redirect($sUrl);
         }
@@ -51,7 +51,7 @@ class BxGoogleConModule extends BxBaseModConnectModule
         require_once(BX_DIRECTORY_PATH_INC . 'design.inc.php');
 
         // check CSRF token
-        if ($this->_getCsrfToken() != bx_get('state')) {
+        if ($this->_getToken() != bx_get('state')) {
             $this->_oTemplate->getPage(_t('_Error'), MsgBox(_t('_sys_connect_state_invalid')));
             return;
         }
@@ -136,32 +136,6 @@ class BxGoogleConModule extends BxBaseModConnectModule
         return $aProfileFields;
     }
 
-    protected function _genCsrfToken($bReturn = false)
-    {
-        if (getParam('sys_security_form_token_enable') != 'on' || defined('BX_DOL_CRON_EXECUTE'))
-            return false;
-
-        $oSession = BxDolSession::getInstance();
-
-        $iCsrfTokenLifetime = (int)$this->_oDb->getParam('sys_security_form_token_lifetime');
-        if ($oSession->getValue('bx_googlecon_csrf_token') === false || ($iCsrfTokenLifetime != 0 && time() - (int)$oSession->getValue('csrf_token_time') > $iCsrfTokenLifetime)) {
-            $sToken = genRndPwd(20, false);
-            $oSession->setValue('bx_googlecon_csrf_token', $sToken);
-            $oSession->setValue('bx_googlecon_csrf_token_time', time());
-        }
-        else {
-            $sToken = $oSession->getValue('bx_googlecon_csrf_token');
-        }
-
-        return $sToken;
-    }
-
-    protected function _getCsrfToken()
-    {
-        $oSession = BxDolSession::getInstance();
-        return $oSession->getValue('bx_googlecon_csrf_token');
-    }
-
 }
 
 /** @} */

modules/boonex/linkedin_connect/classes/BxLinkedinModule.php

@@ -40,7 +40,7 @@ class BxLinkedinModule extends BxBaseModConnectModule
                 'client_id' => $this->_oConfig->sApiID,
                 'redirect_uri' => $this->_oConfig->sPageHandle,
                 'scope' => $this->_oConfig->sScope,
-                'state' => $this->_genCsrfToken(),
+                'state' => $this->_genToken(),
             ));
             $this->_redirect($sUrl);
         }
@@ -51,7 +51,7 @@ class BxLinkedinModule extends BxBaseModConnectModule
         require_once(BX_DIRECTORY_PATH_INC . 'design.inc.php');
 
         // check CSRF token
-        if ($this->_getCsrfToken() != bx_get('state')) {
+        if ($this->_getToken() != bx_get('state')) {
             $this->_oTemplate->getPage(_t('_Error'), MsgBox(_t('_sys_connect_state_invalid')));
             return;
         }
@@ -135,33 +135,6 @@ class BxLinkedinModule extends BxBaseModConnectModule
         
         return $aProfileFields;
     }
-
-    protected function _genCsrfToken($bReturn = false)
-    {
-        if (getParam('sys_security_form_token_enable') != 'on' || defined('BX_DOL_CRON_EXECUTE'))
-            return false;
-
-        $oSession = BxDolSession::getInstance();
-
-        $iCsrfTokenLifetime = (int)$this->_oDb->getParam('sys_security_form_token_lifetime');
-        if ($oSession->getValue('bx_linkedin_csrf_token') === false || ($iCsrfTokenLifetime != 0 && time() - (int)$oSession->getValue('csrf_token_time') > $iCsrfTokenLifetime)) {
-            $sToken = genRndPwd(20, false);
-            $oSession->setValue('bx_linkedin_csrf_token', $sToken);
-            $oSession->setValue('bx_linkedin_csrf_token_time', time());
-        }
-        else {
-            $sToken = $oSession->getValue('bx_linkedin_csrf_token');
-        }
-
-        return $sToken;
-    }
-
-    protected function _getCsrfToken()
-    {
-        $oSession = BxDolSession::getInstance();
-        return $oSession->getValue('bx_linkedin_csrf_token');
-    }
-
 }
 
 /** @} */

modules/boonex/twitter_connect/classes/BxTwitterModule.php

@@ -54,7 +54,7 @@ class BxTwitterModule extends BxBaseModConnectModule
     {
         require_once(BX_DIRECTORY_PATH_INC . 'design.inc.php');
 
-        // check CSRF token
+        // check token
         if (empty($_GET['oauth_token'])) {
             $this->_oTemplate->getPage(_t('_Error'), MsgBox(_t('_bx_twitter_error_no_oauth_token')));
             return;

modules/boonex/una_connect/classes/BxUnaConModule.php

@@ -40,7 +40,7 @@ class BxUnaConModule extends BxBaseModConnectModule
                 'client_id' => $this->_oConfig->sApiID,
                 'redirect_uri' => $this->_oConfig->sPageHandle,
                 'scope' => $this->_oConfig->sScope,
-                'state' => $this->_genCsrfToken(),
+                'state' => $this->_genToken(),
             ));
             $this->_redirect($sUrl);
         }
@@ -50,8 +50,8 @@ class BxUnaConModule extends BxBaseModConnectModule
     {
         require_once(BX_DIRECTORY_PATH_INC . 'design.inc.php');
 
-        // check CSRF token
-        if ($this->_getCsrfToken() != bx_get('state')) {
+        // check token
+        if ($this->_getToken() != bx_get('state')) {
             $this->_oTemplate->getPage(_t('_Error'), MsgBox(_t('_sys_connect_state_invalid')));
             return;
         }
@@ -134,33 +134,6 @@ class BxUnaConModule extends BxBaseModConnectModule
         
         return $aProfileFields;
     }
-
-    protected function _genCsrfToken($bReturn = false)
-    {
-        if (getParam('sys_security_form_token_enable') != 'on' || defined('BX_DOL_CRON_EXECUTE'))
-            return false;
-
-        $oSession = BxDolSession::getInstance();
-
-        $iCsrfTokenLifetime = (int)$this->_oDb->getParam('sys_security_form_token_lifetime');
-        if ($oSession->getValue('bx_unacon_csrf_token') === false || ($iCsrfTokenLifetime != 0 && time() - (int)$oSession->getValue('csrf_token_time') > $iCsrfTokenLifetime)) {
-            $sToken = genRndPwd(20, false);
-            $oSession->setValue('bx_unacon_csrf_token', $sToken);
-            $oSession->setValue('bx_unacon_csrf_token_time', time());
-        }
-        else {
-            $sToken = $oSession->getValue('bx_unacon_csrf_token');
-        }
-
-        return $sToken;
-    }
-
-    protected function _getCsrfToken()
-    {
-        $oSession = BxDolSession::getInstance();
-        return $oSession->getValue('bx_unacon_csrf_token');
-    }
-
 }
 
 /** @} */