CVE-2022-0245: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2022-01-18T06:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgedit.tpl.php, lhc_web/design/defaulttheme/tpl/lhchat/newcannedmsg.tpl.php, lhc_web/modules/lhchat/cannedmsgedit.php, lhc_web/modules/lhchat/newcannedmsg.php, lhc_web/modules/lhgroupchat/options.php, lhc_web/modules/lhnotifications/settings.php
Commit date: 2022-01-17 00:21:40 -0500
Commit message: CSRF tokens

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgedit.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgedit.tpl.php
index 666c5d3364e..3aa7029819e 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgedit.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgedit.tpl.php
@@ -10,10 +10,12 @@
 
 <?php include(erLhcoreClassDesign::designtpl('lhchat/cannedmsg/confirm_global.tpl.php'));?>
 
 <form action="<?php echo erLhcoreClassDesign::baseurl('chat/cannedmsgedit')?>/<?php echo $canned_message->id?>" method="post" onsubmit="return confirmSave()">
 
+    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
+
     <?php include(erLhcoreClassDesign::designtpl('lhchat/cannedmsgform.tpl.php'));?>
     
     <div class="btn-group" role="group" aria-label="...">
 	  <input type="submit" class="btn btn-secondary" name="Save_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/>
       <input type="submit" class="btn btn-secondary" name="Update_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Update');?>"/>
diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/newcannedmsg.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/newcannedmsg.tpl.php
index 16ac793bb8a..169f078209b 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/newcannedmsg.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/newcannedmsg.tpl.php
@@ -3,11 +3,13 @@
 <?php if (isset($errors)) : ?>
 	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
 <?php endif; ?>
 
 <form action="<?php echo erLhcoreClassDesign::baseurl('chat/newcannedmsg')?>" method="post">
-    
+
+    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
+
     <?php include(erLhcoreClassDesign::designtpl('lhchat/cannedmsgform.tpl.php'));?>
 	
 	<div class="btn-group" role="group" aria-label="...">
 	   <input type="submit" class="btn btn-secondary" name="Save_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save');?>"/></li>
 	   <input type="submit" class="btn btn-secondary" name="Cancel_action" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Cancel');?>"/></li>
diff --git a/lhc_web/modules/lhchat/cannedmsgedit.php b/lhc_web/modules/lhchat/cannedmsgedit.php
index e3ae23ff741..7a9aeeb1c7c 100644
--- a/lhc_web/modules/lhchat/cannedmsgedit.php
+++ b/lhc_web/modules/lhchat/cannedmsgedit.php
@@ -27,10 +27,15 @@ if ( isset($_POST['Cancel_action']) ) {
     exit;
 }
 
 if (isset($_POST['Update_action']) || isset($_POST['Save_action'])  )
 {
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('chat/cannedmsg');
+        exit;
+    }
+
    $previousState = $Msg->getState();
 
    $Errors = erLhcoreClassAdminChatValidatorHelper::validateCannedMessage($Msg, $userDepartments);
    
    erLhcoreClassChatEventDispatcher::getInstance()->dispatch('chat.canned_msg_before_save',array('departments' => $userDepartments, 'errors' => & $Errors, 'msg' => & $Msg, 'scope' => 'global'));
diff --git a/lhc_web/modules/lhchat/newcannedmsg.php b/lhc_web/modules/lhchat/newcannedmsg.php
index dedf8df363d..adf5febae88 100644
--- a/lhc_web/modules/lhchat/newcannedmsg.php
+++ b/lhc_web/modules/lhchat/newcannedmsg.php
@@ -15,10 +15,15 @@ if ( isset($_POST['Cancel_action']) ) {
     exit;
 }
 
 if (isset($_POST['Save_action']))
 {
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('chat/cannedmsg');
+        exit;
+    }
+
     $Errors = erLhcoreClassAdminChatValidatorHelper::validateCannedMessage($CannedMessage, $userDepartments);
 
     erLhcoreClassChatEventDispatcher::getInstance()->dispatch('chat.before_newcannedmsg', array('departments' => $userDepartments, 'scope' => 'global', 'errors' => & $Errors, 'msg' => & $CannedMessage));
 
     if (count($Errors) == 0)
diff --git a/lhc_web/modules/lhgroupchat/options.php b/lhc_web/modules/lhgroupchat/options.php
index e5659869ed7..4db8cdcc71e 100644
--- a/lhc_web/modules/lhgroupchat/options.php
+++ b/lhc_web/modules/lhgroupchat/options.php
@@ -6,10 +6,15 @@ $gcOptions = erLhcoreClassModelChatConfig::fetch('groupchat_options');
 $data = (array)$gcOptions->data;
 
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('groupchat/options');
+        exit;
+    }
+
     $definition = array(
         'supervisor' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'int'
         )
     );
diff --git a/lhc_web/modules/lhnotifications/settings.php b/lhc_web/modules/lhnotifications/settings.php
index 1c48313602c..2f9ee252333 100644
--- a/lhc_web/modules/lhnotifications/settings.php
+++ b/lhc_web/modules/lhnotifications/settings.php
@@ -5,10 +5,15 @@ $tpl = erLhcoreClassTemplate::getInstance('lhnotifications/settings.tpl.php');
 $nSettings = erLhcoreClassModelChatConfig::fetch('notifications_settings');
 $data = (array)$nSettings->data;
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('notifications/index');
+        exit;
+    }
+
     $definition = array(
         'enabled' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'boolean'
         ),
         'require_interaction' => new ezcInputFormDefinitionElement(

Fixed code:     <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>


    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('chat/cannedmsg');
        exit;
    }

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('chat/cannedmsg');
        exit;
    }

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('groupchat/options');
        exit;
    }

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('notifications/index');
        exit;
    }