8000 Minor security improvements by ozh · Pull Request #3034 · YOURLS/YOURLS · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Minor security improvements #3034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 24, 2021
Merged

Minor security improvements #3034

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
53b9c9a
Prevent iframe jacking
ozh Aug 24, 2021
08cdb32
Enforce nonce on admin login screen
ozh Aug 24, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions admin/admin-ajax.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
// This file will output a JSON string
yourls_content_type_header( 'application/json' );
yourls_no_cache_headers();
yourls_no_frame_header();

if( !isset( $_REQUEST['action'] ) )
die();
Expand Down
6 changes: 6 additions & 0 deletions includes/functions-auth.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,12 @@ function yourls_is_valid_user() {
*/
function yourls_check_username_password() {
global $yourls_user_passwords;

// If login form (not API), check for nonce
if(!yourls_is_API()) {
yourls_verify_nonce('admin_login');
}

if( isset( $yourls_user_passwords[ $_REQUEST['username'] ] ) && yourls_check_password_hash( $_REQUEST['username'], $_REQUEST['password'] ) ) {
yourls_set_user( $_REQUEST['username'] );
return true;
Expand Down
2 changes: 2 additions & 0 deletions includes/functions-html.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ function yourls_html_head( $context = 'index', $title = '' ) {
// Force no cache for all admin pages
if( yourls_is_admin() && !headers_sent() ) {
yourls_no_cache_headers();
yourls_no_frame_header();
yourls_content_type_header( yourls_apply_filter( 'html_head_content-type', 'text/html' ) );
yourls_do_action( 'admin_headers', $context, $title );
}
Expand Down Expand Up @@ -725,6 +726,7 @@ function yourls_login_screen( $error_msg = '' ) {
yourls_do_action( 'login_form_bottom' );
?>
<p style="text-align: right;">
<?php yourls_nonce_field('admin_login'); ?>
<input type="submit" id="submit" name="submit" value="<?php yourls_e( 'Login' ); ?>" class="button" />
</p>
<?php
Expand Down
25 changes: 24 additions & 1 deletion includes/functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,30 @@ function yourls_no_cache_headers() {
}

/**
* Send a filerable content type header
* Send header to prevent display within a frame from another site (avoid clickjacking)
*
* This header makes it impossible for an external site to display YOURLS admin within a frame,
* which allows for clickjacking.
* See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
* This said, the whole function is shuntable : legit uses of iframes should be still possible.
*
* @since 1.8.1
* @return void|mixed
*/
function yourls_no_frame_header() {
// Allow plugins to short-circuit the whole function
$pre = yourls_apply_filter( 'shunt_no_frame_header', false );
if ( false !== $pre ) {
return $pre;
}

if( !headers_sent() ) {
header( 'X-Frame-Options: SAMEORIGIN' );
}
}

/**
* Send a filterable content type header
*
* @since 1.7
* @param string $type content type ('text/html', 'application/json', ...)
Expand Down
0