fluxbb/fluxbb — pull request #95 by Aslai (2014-01-08 17:04:59+00:00)
Title: Fixed a bunch of XSRF issues

With the way it currently is, I've successfully crafted XSRF links that can force anyone to post an arbitrary post on any forum, and can force non-admods to do a ton of things, specifically:

- Modify any aspect of their profile such as timezone, signature, and even email if secure email updating is not enabled.
- Post arbitrary posts anywhere on the forum.
- Edit any post they've made.
- Submit bogus reports.

It is also possible to carry out an XSRF attack using only XMLHttpRequest objects, so a potentially malicious site could do an attack completely unnoticed. One could even spam posts on a timer in order to post as many as possible without tripping the flood limiter.

These are some pretty serious issues and I'm surprised they made it this far. All I've done is made confirm_referrer() throw a bad HTTP_REFERER error if the valid script name is an empty string, and the host is different from the forum's base url. I then inserted confirm_referrer(''); wherever one was lacking. The reason why I didn't just do confirm_referrer('scriptname') is because some things (such as posting) are accessible from multiple scripts, so my approach is very flexible. However, it would be vulnerable if there's an unsafe redirect somewhere in the code, though there doesn't appear to be one currently.