CVE-2022-0245 (published 2022-01-18T06:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/livehelperchat/livehelperchat
commit_details: repo_url: https://github.com/livehelperchat/livehelperchat
author: Remigijus Kiminas
author_date: 2022-01-17 00:21:40-05:00
msg: CSRF tokens
repository: repo_url: https://github.com/livehelperchat/livehelperchat
repo_name: LiveHelperChat/livehelperchat
description: Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot.
repo_language: PHP
owner: livehelperchat
file_changes: filename: cannedmsgedit.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,8 @@
 
 <form action="<?php echo erLhcoreClassDesign::baseurl('chat/cannedmsgedit')?>/<?php echo $canned_message->id?>" method="post" onsubmit="return confirmSave()">
 
+    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
+
     <?php include(erLhcoreClassDesign::designtpl('lhchat/cannedmsgform.tpl.php'));?>
     
     <div class="btn-group" role="group" aria-label="...">

programming_language: PHP
filename: newcannedmsg.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,9 @@
 <?php endif; ?>
 
 <form action="<?php echo erLhcoreClassDesign::baseurl('chat/newcannedmsg')?>" method="post">
-    
+
+    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
+
     <?php include(erLhcoreClassDesign::designtpl('lhchat/cannedmsgform.tpl.php'));?>
 	
 	<div class="btn-group" role="group" aria-label="...">

programming_language: PHP
filename: cannedmsgedit.php
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,11 @@ if ( isset($_POST['Cancel_action']) ) {
 
 if (isset($_POST['Update_action']) || isset($_POST['Save_action'])  )
 {
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('chat/cannedmsg');
+        exit;
+    }
+
    $previousState = $Msg->getState();
 
    $Errors = erLhcoreClassAdminChatValidatorHelper::validateCannedMessage($Msg, $userDepartments);

programming_language: PHP
filename: newcannedmsg.php
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,11 @@ if ( isset($_POST['Cancel_action']) ) {
 
 if (isset($_POST['Save_action']))
 {
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('chat/cannedmsg');
+        exit;
+    }
+
     $Errors = erLhcoreClassAdminChatValidatorHelper::validateCannedMessage($CannedMessage, $userDepartments);
 
     erLhcoreClassChatEventDispatcher::getInstance()->dispatch('chat.before_newcannedmsg', array('departments' => $userDepartments, 'scope' => 'global', 'errors' => & $Errors, 'msg' => & $CannedMessage));

programming_language: PHP
filename: options.php
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,11 @@ $data = (array)$gcOptions->data;
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('groupchat/options');
+        exit;
+    }
+
     $definition = array(
         'supervisor' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'int'

programming_language: PHP
filename: settings.php
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,11 @@ $data = (array)$nSettings->data;
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('notifications/index');
+        exit;
+    }
+
     $definition = array(
         'enabled' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'boolean'

programming_language: PHP