cabennett85/gittest — Issue #658: Security - Deletions should be Posts, Use security token
Author: cabennett85
Created: 2012-03-02 00:05:38+00:00
State: open

There's a CSRF opportunity that can allow someone to craft a script to delete large amounts of our content. From our security audit:

Discovered that to delete a story, it can be done simply by passing "d=true" in the URL of the story on uwrite.php (uwrite.php?d=true&e=1135627), this means I could create a script to generate URLs for uwrite.php?d=true&e=1 to uwrite.php?d=true&e=999999999 and lure members to the site where it is hosted and potentially remove all stories posted. This is the same for mail at member_communication.php and probably the same for any other pages which allow deleting of content. (CSRF)

Let's start by fixing / testing on story deletion. Then we can figure out how to expand the fix.

I'll follow with more details in the comments.