CVE-2012-4393: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: PHP
Files changed: settings/ajax/changepassword.php, settings/ajax/creategroup.php, settings/ajax/createuser.php, settings/ajax/disableapp.php, settings/ajax/enableapp.php, settings/ajax/lostpassword.php, settings/ajax/removegroup.php, settings/ajax/removeuser.php, settings/ajax/setlanguage.php, settings/ajax/setloglevel.php, settings/ajax/setquota.php, settings/ajax/togglegroups.php
Commit date: 2012-07-20 20:39:20 +0200
Commit message: CSRF checks

Diff: diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php
index 860ea9878..388885b6f 100644
--- a/settings/ajax/changepassword.php
+++ b/settings/ajax/changepassword.php
@@ -1,9 +1,10 @@
 <?php
 
 // Init owncloud
 require_once('../../lib/base.php');
+OCP\JSON::callCheck();
 
 $username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser();
 $password = $_POST["password"];
 $oldPassword=isset($_POST["oldpassword"])?$_POST["oldpassword"]:'';
 
diff --git a/settings/ajax/creategroup.php b/settings/ajax/creategroup.php
index 57d82e7bd..a7fab1c45 100644
--- a/settings/ajax/creategroup.php
+++ b/settings/ajax/creategroup.php
@@ -1,9 +1,10 @@
 <?php
 
 // Init owncloud
 require_once('../../lib/base.php');
+OCP\JSON::callCheck();
 
 // Check if we are a user
 if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )){
 	OC_JSON::error(array("data" => array( "message" => "Authentication error" )));
 	exit();
diff --git a/settings/ajax/createuser.php b/settings/ajax/createuser.php
index 6714711bc..508b4bf94 100644
--- a/settings/ajax/createuser.php
+++ b/settings/ajax/createuser.php
@@ -1,9 +1,10 @@
 <?php
 
 // Init owncloud
 require_once('../../lib/base.php');
+OCP\JSON::callCheck();
 
 // Check if we are a user
 if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )){
 	OC_JSON::error(array("data" => array( "message" => "Authentication error" )));
 	exit();
diff --git a/settings/ajax/disableapp.php b/settings/ajax/disableapp.php
index 53e9be379..cc0069887 100644
--- a/settings/ajax/disableapp.php
+++ b/settings/ajax/disableapp.php
@@ -1,9 +1,10 @@
 <?php
 // Init owncloud
 require_once('../../lib/base.php');
 OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
 OC_JSON::setContentTypeHeader();
 
 OC_App::disable($_POST['appid']);
 
 OC_JSON::success();
diff --git a/settings/ajax/enableapp.php b/settings/ajax/enableapp.php
index cb116ebe4..bd53a5021 100644
--- a/settings/ajax/enableapp.php
+++ b/settings/ajax/enableapp.php
@@ -1,10 +1,11 @@
 <?php
 
 // Init owncloud
 require_once('../../lib/base.php');
 OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
 OC_JSON::setContentTypeHeader();
 
 if(OC_App::enable($_POST['appid'])){
 	OC_JSON::success();
 }else{
diff --git a/settings/ajax/lostpassword.php b/settings/ajax/lostpassword.php
index 9c31c9ce8..976fdff24 100644
--- a/settings/ajax/lostpassword.php
+++ b/settings/ajax/lostpassword.php
@@ -2,15 +2,17 @@
 
 // Init owncloud
 require_once('../../lib/base.php');
 
 OC_JSON::checkLoggedIn();
+OCP\JSON::callCheck();
 
 $l=OC_L10N::get('core');
 
 // Get data
-if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){	$email=trim($_POST['email']);
+if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){
+	$email=trim($_POST['email']);
 	OC_Preferences::setValue(OC_User::getUser(),'settings','email',$email);
 	OC_JSON::success(array("data" => array( "message" => $l->t("Email saved") )));
 }else{
 	OC_JSON::error(array("data" => array( "message" => $l->t("Invalid email") )));
 }
diff --git a/settings/ajax/removegroup.php b/settings/ajax/removegroup.php
index 4d3647818..19cbe51fd 100644
--- a/settings/ajax/removegroup.php
+++ b/settings/ajax/removegroup.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 require_once('../../lib/base.php');
 
 OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
 
 $name = $_POST["groupname"];
 
 // Return Success story
 if( OC_Group::deleteGroup( $name )){
diff --git a/settings/ajax/removeuser.php b/settings/ajax/removeuser.php
index 2c288997a..63388b3ca 100644
--- a/settings/ajax/removeuser.php
+++ b/settings/ajax/removeuser.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 require_once('../../lib/base.php');
 
 OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
 
 $username = $_POST["username"];
 
 // Return Success story
 if( OC_User::deleteUser( $username )){
diff --git a/settings/ajax/setlanguage.php b/settings/ajax/setlanguage.php
index e3b00c3bc..bc70d09ac 100644
--- a/settings/ajax/setlanguage.php
+++ b/settings/ajax/setlanguage.php
@@ -4,11 +4,11 @@
 require_once('../../lib/base.php');
 
 $l=OC_L10N::get('settings');
 
 OC_JSON::checkLoggedIn();
-
+OCP\JSON::callCheck();
 
 // Get data
 if( isset( $_POST['lang'] ) ){
 	$languageCodes=OC_L10N::findAvailableLanguages();
 	$lang=$_POST['lang'];
diff --git a/settings/ajax/setloglevel.php b/settings/ajax/setloglevel.php
index 298cbd647..4b97ba2aa 100644
--- a/settings/ajax/setloglevel.php
+++ b/settings/ajax/setloglevel.php
@@ -5,10 +5,11 @@
  * See the COPYING-README file.
  */
 
 require_once('../../lib/base.php');
 OC_Util::checkAdminUser();
+OCP\JSON::callCheck();
 
 OC_Config::setValue( 'loglevel', $_POST['level'] );
 
 echo 'true';
 
diff --git a/settings/ajax/setquota.php b/settings/ajax/setquota.php
index f59017600..44c206782 100644
--- a/settings/ajax/setquota.php
+++ b/settings/ajax/setquota.php
@@ -7,10 +7,11 @@
 
 // Init owncloud
 require_once('../../lib/base.php');
 
 OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
 
 $username = isset($_POST["username"])?$_POST["username"]:'';
 
 //make sure the quota is in the expected format
 $quota=$_POST["quota"];
diff --git a/settings/ajax/togglegroups.php b/settings/ajax/togglegroups.php
index f76e22f51..02b2b6319 100644
--- a/settings/ajax/togglegroups.php
+++ b/settings/ajax/togglegroups.php
@@ -2,10 +2,11 @@
 
 // Init owncloud
 require_once('../../lib/base.php');
 
 OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
 
 $success = true;
 $error = "add user to";
 $action = "add";
 

Vulnerable code: if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){	$email=trim($_POST['email']);

Fixed code: OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){
	$email=trim($_POST['email']);
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();