Skip to content

Commit 45c9672

Browse files
mobula9mobula9
authored
Merge pull request #7 from crowdsecurity/security-pass
security pass
2 parents 456e620 + 6e343b4 commit 45c9672

File tree

8 files changed

+588
-511
lines changed

8 files changed

+588
-511
lines changed

‎inc/admin/advanced-settings.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ function adminAdvancedSettings()
2727
<p>With the stream mode, every decision is retrieved in an asynchronous way. 3 advantages: <br>&nbsp;1) Inivisible latency when loading pages<br>&nbsp;2) The IP verifications works even if your CrowdSec is not reachable.<br>&nbsp;3) The API can never be overloaded by the WordPress traffic</p>
2828
<p>Note: This method has one limit: all the decisions updates since the previous resync will not be taken in account until the next resync.</p>'.
2929
(get_option('crowdsec_stream_mode') ?
30-
'<p><input id="crowdsec_refresh_cache" style="margin-right:10px" type="button" value="Refresh the cache now" class="button button-secondary button-small" onclick="document.getElementById(\'crowdsec_ation_refresh_cache\').submit();"></p>' :
30+
'<p><input id="crowdsec_refresh_cache" style="margin-right:10px" type="button" value="Refresh the cache now" class="button button-secondary button-small" onclick="document.getElementById(\'crowdsec_action_refresh_cache\').submit();"></p>' :
3131
'<p><input id="crowdsec_refresh_cache" style="margin-right:10px" type="button" disabled="disabled" value="Refresh the cache now" class="button button-secondary button-small"></p>'));
3232

3333
// Field "crowdsec_stream_mode_refresh_frequency"
@@ -61,7 +61,7 @@ function adminAdvancedSettings()
6161
** Section "Cache" **
6262
********************/
6363

64-
add_settings_section('crowdsec_admin_advanced_cache', 'Caching configuration <input id="crowdsec_clear_cache" style="margin-left: 7px;margin-top: -3px;" type="button" value="Clear now" class="button button-secondary button-small" onclick="if (confirm(\'Are you sure you want to completely clear the cache?\')) document.getElementById(\'crowdsec_ation_clear_cache\').submit();">', function () {
64+
add_settings_section('crowdsec_admin_advanced_cache', 'Caching configuration <input id="crowdsec_clear_cache" style="margin-left: 7px;margin-top: -3px;" type="button" value="Clear now" class="button button-secondary button-small" onclick="if (confirm(\'Are you sure you want to completely clear the cache?\')) document.getElementById(\'crowdsec_action_clear_cache\').submit();">', function () {
6565
?>
6666
<p>Polish the decisions cache settings by selecting the best technology or the cache durations best suited to your use.</p>
6767
<?php
@@ -141,7 +141,7 @@ function adminAdvancedSettings()
141141

142142
return $input;
143143
}, ((CROWDSEC_CACHE_SYSTEM_PHPFS === get_option('crowdsec_cache_system')) ?
144-
'<input style="margin-right:10px" type="button" id="crowdsec_prune_cache" value="Prune now" class="button button-secondary" onclick="document.getElementById(\'crowdsec_ation_prune_cache\').submit();">' : '').
144+
'<input style="margin-right:10px" type="button" id="crowdsec_prune_cache" value="Prune now" class="button button-secondary" onclick="document.getElementById(\'crowdsec_action_prune_cache\').submit();">' : '').
145145
'<p>The File system cache is faster than calling LAPI. Redis or Memcached is faster than the File System cache.</p>', [
146146
CROWDSEC_CACHE_SYSTEM_PHPFS => 'File system',
147147
CROWDSEC_CACHE_SYSTEM_REDIS => 'Redis',

‎inc/admin/init.php

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,17 +90,29 @@ function pruneBouncerCacheInAdminPage()
9090
}
9191

9292
// ACTIONS
93-
add_action('admin_post_clear_cache', function () {
93+
add_action('admin_post_crowdsec_clear_cache', function () {
94+
if (
95+
!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'crowdsec_clear_cache')) {
96+
die('This link expired.');
97+
}
9498
clearBouncerCacheInAdminPage();
9599
header("Location: {$_SERVER['HTTP_REFERER']}");
96100
exit(0);
97101
});
98-
add_action('admin_post_refresh_cache', function () {
102+
add_action('admin_post_crowdsec_refresh_cache', function () {
103+
if (
104+
!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'crowdsec_refresh_cache')) {
105+
die('This link expired.');
106+
}
99107
refreshBouncerCacheInAdminPage();
100108
header("Location: {$_SERVER['HTTP_REFERER']}");
101109
exit(0);
102110
});
103-
add_action('admin_post_prune_cache', function () {
111+
add_action('admin_post_crowdsec_prune_cache', function () {
112+
if (
113+
!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'crowdsec_prune_cache')) {
114+
die('This link expired.');
115+
}
104116
pruneBouncerCacheInAdminPage();
105117
header("Location: {$_SERVER['HTTP_REFERER']}");
106118
exit(0);

‎inc/scheduling.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ function crowdSecRefreshBlocklist()
3434

3535
// Create the hook that the schedule will call
3636
add_action(CROWDSEC_REFRESH_BLOCKLIST_CRON_HOOK, 'crowdSecRefreshBlocklist');
37-
//echo '<pre>'; print_r( _get_cron_array() ); echo '</pre>';die;
3837

3938
function unscheduleBlocklistRefresh()
4039
{

‎inc/templates/advanced-settings.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,17 @@ function updateDsnDisplay () {
4242
</form>
4343

4444
<br/>
45-
<form action="<?php echo admin_url('admin-post.php'); ?>" method="post" id="crowdsec_ation_clear_cache">
46-
<input type="hidden" name="action" value="clear_cache">
45+
<form action="<?php echo admin_url('admin-post.php'); ?>" method="post" id="crowdsec_action_clear_cache">
46+
<input type="hidden" name="action" value="crowdsec_clear_cache">
47+
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce('crowdsec_clear_cache'); ?>">
4748
</form>
48-
<form action="<?php echo admin_url('admin-post.php'); ?>" method="post" id="crowdsec_ation_refresh_cache">
49-
<input type="hidden" name="action" value="refresh_cache">
49+
<form action="<?php echo admin_url('admin-post.php'); ?>" method="post" id="crowdsec_action_refresh_cache">
50+
<input type="hidden" name="action" value="crowdsec_refresh_cache">
51+
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce('crowdsec_refresh_cache'); ?>">
5052
</form>
51-
<form action="<?php echo admin_url('admin-post.php'); ?>" method="post" id="crowdsec_ation_prune_cache">
52-
<input type="hidden" name="action" value="prune_cache">
53+
<form action="<?php echo admin_url('admin-post.php'); ?>" method="post" id="crowdsec_action_prune_cache">
54+
<input type="hidden" name="action" value="crowdsec_prune_cache">
55+
<input type="hidden" name="nonce" value="<?php echo wp_create_nonce('crowdsec_prune_cache'); ?>">
5356
</form>
5457
</div>
5558
</div>

‎scripts/publish-release.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ fi
3232
git add $git_base_dir/inc/constants.php
3333
git add $git_base_dir/crowdsec.php
3434

35-
git tag v$NEW_GIT_VERSION_WITHOUT_V_PREFIX
3635
git commit -m "bump version to v$NEW_GIT_VERSION_WITHOUT_V_PREFIX"
36+
git tag v$NEW_GIT_VERSION_WITHOUT_V_PREFIX
3737
git push
3838
git push origin v$NEW_GIT_VERSION_WITHOUT_V_PREFIX
3939
gh release create --draft v$NEW_GIT_VERSION_WITHOUT_V_PREFIX --title v$NEW_GIT_VERSION_WITHOUT_V_PREFIX

‎tests-local.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ done
2020

2121

2222
# Run tests
23+
rm -rf ./tests/functional/screenshots
2324
WORDPRESS_VERSION=$WORDPRESS_VERSION WATCHER_LOGIN=$WATCHER_LOGIN WATCHER_PASSWORD=$WATCHER_PASSWORD \
2425
LAPI_URL_FROM_CONTAINERS='http://crowdsec:8080' LAPI_URL_FROM_HOST='http://localhost:8080' \
2526
yarn --cwd ./tests/functional test \

0 commit comments

Comments
 (0)