Merge pull request #1928 from shazar-webkul/gli-3244

Fixed: Add missing token check to file manager requests on Backoffice

admin-dev/filemanager/config/config.php

@@ -18,6 +18,13 @@ $cms_accesses = Profile::getProfileAccess(Context::getContext()->employee->id_pr
 if (!$products_accesses['edit'] && !$cms_accesses['edit']) {
     die(Tools::displayError());
 }
+
+$tokenTab = $products_accesses['edit'] ? 'AdminProducts' : 'AdminCmsContent';
+$isMutatingRequest = isset($_POST['submit']) || in_array(basename($_SERVER['SCRIPT_NAME']), array('execute.php', 'upload.php', 'ajax_calls.php'), true);
+
+if ($isMutatingRequest && (!isset($_REQUEST['token']) || !hash_equals(Tools::getAdminTokenLite($tokenTab), (string) $_REQUEST['token']))) {
+    die('invalid token');
+}
 //------------------------------------------------------------------------------
 // DON'T COPY THIS VARIABLES IN FOLDERS config.php FILES
 //------------------------------------------------------------------------------

admin-dev/filemanager/dialog.php

@@ -2,6 +2,7 @@
 include('config/config.php');
 
 $_SESSION["verify"] = "RESPONSIVEfilemanager";
+$fmTokenValue = Tools::getAdminTokenLite($products_accesses['edit'] ? 'AdminProducts' : 'AdminCmsContent');
 
 if (isset($_POST['submit'])) {
     include('upload.php');
@@ -242,6 +243,7 @@ if (isset($_POST['submit'])) {
 		<script>
 			var ext_img = new Array('<?php echo implode("','", $ext_img)?>');
 			var allowed_ext = new Array('<?php echo implode("','", $ext)?>');
+			var fmToken = "<?php echo $fmTokenValue; ?>";
 			var loading_bar =<?php echo $loading_bar?"true":"false";
     ?>;
 			var image_editor =<?php echo $aviary_active?"true":"false";
@@ -257,6 +259,7 @@ if (isset($_POST['submit'])) {
 				maxFilesize: <?php echo $MaxSizeUpload;
     ?>, // MB
 				url: "upload.php",
+				params: {token: fmToken},
 				accept: function (file, done) {
 					var extension = file.name.split('.').pop();
 					extension = extension.toLowerCase();
@@ -286,7 +289,7 @@ if (isset($_POST['submit'])) {
 						$.ajax({
 							type: "POST",
 							url: "ajax_calls.php?action=save_img",
-							data: { url: newURL, path: $('#sub_folder').val() + $('#fldr_value').val(), name: $('#aviary_img').data('name') }
+							data: { url: newURL, path: $('#sub_folder').val() + $('#fldr_value').val(), name: $('#aviary_img').data('name'), token: fmToken }
 						}).done(function (msg) {
 							featherEditor.close();
 							d = new Date();
@@ -391,6 +394,7 @@ if (isset($_POST['submit'])) {
     ?>"/>
 							<input type="hidden" name="path_thumb" value="<?php echo Tools::safeOutput($subfolder.$subdir);
     ?>"/>
+							<input type="hidden" name="token" value="<?php echo Tools::safeOutput($fmTokenValue); ?>"/>
 
 							<div class="fallback">
 								<?php echo lang_Upload_file ?>:<br/>
@@ -1138,6 +1142,7 @@ if (isset($_POST['submit'])) {
     ?>"
 						   title="<?php echo lang_Preview ?>" data-url="ajax_calls.php?action=media_preview&title=<?php echo Tools::safeOutput($filename);
     ?>&file=<?php echo Tools::safeOutput(Context::getContext()->shop->physical_uri.'img/cms/'.$subfolder.$subdir.$file);
+    ?>&token=<?php echo urlencode($fmTokenValue);
     ?>"
 						   href="javascript:void('');"><i class=" icon-eye-open"></i></a>
 					<?php

admin-dev/filemanager/js/include.js

@@ -35,7 +35,7 @@ $(document).ready(function(){
 			    $.ajax({
 				type: "POST",
 				url: "ajax_calls.php?action=extract",
-				data: { path: m }
+				data: { path: m, token: fmToken }
 			    }).done(function( msg ) {
 				if (msg!="")
 				    bootbox.alert(msg);
@@ -220,7 +220,7 @@ $(document).ready(function(){
 	sortDescending=!sortDescending;
 	if (js_script) {
 	    $.ajax({
-		url: "ajax_calls.php?action=sort&sort_by="+_this.attr('data-sort')+"&descending="+sortDescending
+		url: "ajax_calls.php?action=sort&sort_by="+_this.attr('data-sort')+"&descending="+sortDescending+"&token="+encodeURIComponent(fmToken)
 	    }).done(function( msg ) {
 		    
 	    });
@@ -318,7 +318,7 @@ $(document).ready(function(){
 		$.ajax({
 			  type: "POST",
 			  url: "execute.php?action=create_folder",
-			  data: {path: folder_path, path_thumb: folder_path_thumb}
+			  data: {path: folder_path, path_thumb: folder_path_thumb, token: fmToken}
 			}).done(function( msg ) {
 			setTimeout(function(){window.location.href = $('#refresh').attr('href') + '&' + new Date().getTime();},300);
 			
@@ -336,7 +336,7 @@ $(document).ready(function(){
 	    _this.find('i').addClass('icon-white');
 	    
 	     $.ajax({
-		url: "ajax_calls.php?action=view&type="+_this.attr('data-value')
+		url: "ajax_calls.php?action=view&type="+_this.attr('data-value')+"&token="+encodeURIComponent(fmToken)
 	    }).done(function( msg ) {
 		if (msg!="") {
 		    bootbox.alert(msg);
@@ -719,7 +719,7 @@ function execute_action(action,file1,file2,name,container,function_name){
 	$.ajax({
 	    type: "POST",
 	    url: "execute.php?action="+action,
-	    data: {path: file1, path_thumb: file2, name: name.replace('/','')}
+	    data: {path: file1, path_thumb: file2, name: name.replace('/',''), token: fmToken}
 	}).done(function( msg ) {
 	    if (msg!="") {
 		bootbox.alert(msg);