From 85e0f980e72bbebf94e399d6859f367c8dd1bee2 Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 27 Sep 2019 14:37:48 -0400 Subject: [PATCH] Create custom CSRF Error page. Implements #9799 * Use formatting consistent with other GUI pages * Warns the user about potential dangers of submitting form data (cherry picked from commit da7384c4a42adbcb7c20beba05ff460d0f6da7b3) --- src/usr/local/www/csrf_error.php | 116 +++++++++++++++++++++++++++++++ src/usr/local/www/guiconfig.inc | 6 ++ 2 files changed, 122 insertions(+) create mode 100644 src/usr/local/www/csrf_error.php diff --git a/src/usr/local/www/csrf_error.php b/src/usr/local/www/csrf_error.php new file mode 100644 index 0000000000..1575e85f84 --- /dev/null +++ b/src/usr/local/www/csrf_error.php @@ -0,0 +1,116 @@ + $value) { + if ($key == $GLOBALS['csrf']['input-name']) continue; + $data .= ''; +} + +$logincssfile = "#770101"; +?> + + + + + + + + + <?=gettext("CSRF Error"); ?> + + + + +
+
+
+
+
+
+ +
+
+
+ CSRF check failed +
+
+
+
+ +
+
+
+
+

Missing or expired CSRF token

+

Form session may have expired, cookies may not be enabled, or possible CSRF-based attack.

+

Resubmitting this request may put the firewall at risk or lead to unintended behavior.

+
+ + I understand this warning and wish to resubmit the form data. +
+ +
+ +

Debug:

+ +
+
+
+
+ +
+
+

+ +

+
+
+
+ + + + + + + + diff --git a/src/usr/local/www/guiconfig.inc b/src/usr/local/www/guiconfig.inc index 952d8da87b..594db03874 100644 --- a/src/usr/local/www/guiconfig.inc +++ b/src/usr/local/www/guiconfig.inc @@ -27,12 +27,18 @@ /* THIS MUST BE ABOVE ALL OTHER CODE */ header("X-Frame-Options: SAMEORIGIN"); include_once('phpsessionmanager.inc'); + +function pfSense_csrf_callback() { + include "csrf_error.php"; +} + if (!$nocsrf) { function csrf_startup() { global $config; csrf_conf('rewrite-js', '/csrf/csrf-magic.js'); $timeout_minutes = isset($config['system']['webgui']['session_timeout']) ? $config['system']['webgui']['session_timeout'] : 240; csrf_conf('expires', $timeout_minutes * 60); + csrf_conf('callback', 'pfSense_csrf_callback'); } require_once("csrf/csrf-magic.php"); if ($_SERVER['REQUEST_METHOD'] == 'POST') {