LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CSRF token drift in add_comment and update_ticket endpoints
Lint / PHP (phpcs PSR-12) (push) Failing after 50s
Details
Lint / JS (eslint) (push) Successful in 7s
Details
Lint / PHP requirements (version + extensions) (push) Successful in 20s
Details
Security / PHP Security (semgrep) (push) Successful in 1m0s
Details
Lint / Deploy (push) Has been skipped
Details
Lint / Notify on failure (push) Successful in 2s
Details

Browse Source
This commit is contained in:
jared
2026-07-14 23:19:26 -04:00
parent 622cae8bbd
commit 7a537f46bc
2 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/add_comment.php
+10 -1
View File
@@ -52,9 +52,15 @@ try {
if (!CsrfMiddleware::validateToken($csrfToken)) { if (!CsrfMiddleware::validateToken($csrfToken)) {
http_response_code(403); http_response_code(403);
header('Content-Type: application/json'); header('Content-Type: application/json');
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']); echo json_encode([
'success' => false,
'error' => 'Invalid CSRF token',
'csrf_token' => CsrfMiddleware::getToken()
]);
exit; exit;
} }
// Rotate token after successful validation
$newCsrfToken = CsrfMiddleware::rotateToken();
} }
$currentUser = $_SESSION['user']; $currentUser = $_SESSION['user'];
@@ -208,6 +214,9 @@ try {
if ($result['success']) { if ($result['success']) {
$result['user_name'] = $currentUser['display_name'] ?? $currentUser['username']; $result['user_name'] = $currentUser['display_name'] ?? $currentUser['username'];
$result['user_id'] = $userId; $result['user_id'] = $userId;
if (isset($newCsrfToken)) {
$result['csrf_token'] = $newCsrfToken;
}
} }
// Discard any unexpected output // Discard any unexpected output
api/update_ticket.php
+8 -2
View File
@@ -48,9 +48,14 @@ try {
if (!CsrfMiddleware::validateToken($csrfToken)) { if (!CsrfMiddleware::validateToken($csrfToken)) {
http_response_code(403); http_response_code(403);
header('Content-Type: application/json'); header('Content-Type: application/json');
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']); echo json_encode([
'success' => false,
'error' => 'Invalid CSRF token',
'csrf_token' => CsrfMiddleware::getToken()
]);
exit; exit;
} }
$GLOBALS['newCsrfToken'] = CsrfMiddleware::rotateToken();
} }
$currentUser = $_SESSION['user']; $currentUser = $_SESSION['user'];
@@ -279,7 +284,8 @@ try {
'status' => $updateData['status'], 'status' => $updateData['status'],
'priority' => $updateData['priority'], 'priority' => $updateData['priority'],
'updated_at' => date('Y-m-d H:i:s'), 'updated_at' => date('Y-m-d H:i:s'),
'message' => 'Ticket updated successfully' 'message' => 'Ticket updated successfully',
'csrf_token' => $GLOBALS['newCsrfToken'] ?? null
]; ];
} }
} }