First Commit

include/ajax.csrfToken.php

@@ -0,0 +1,37 @@
+<?php
+
+// if ($school_num == 20158 || $school_num == 3) startLog("ajax.csrfToken.php");
+
+// if (!isset($csrf_token)) writeLog("Token Not Set");
+if (array_key_exists('HTTP_X_CSRF_TOKEN', $_SERVER)) writeLog("_SERVER['HTTP_X_CSRF_TOKEN']: ".$_SERVER['HTTP_X_CSRF_TOKEN']);
+if (array_key_exists('csrf_token', $_GET)) writeLog("_GET['csrf_token']: ".$_GET['csrf_token']);
+if (array_key_exists('csrf_token', $_POST)) writeLog("_POST['csrf_token']: ".$_POST['csrf_token']);
+
+
+// CSRF token validation
+if (!isset($csrf_token) && array_key_exists('HTTP_X_CSRF_TOKEN',$_SERVER)) $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'];
+if (!isset($csrf_token) && array_key_exists('csrf_token',$_GET)) $csrf_token = $_GET['csrf_token'];
+if (!isset($csrf_token) && array_key_exists('csrf_token',$_POST)) $csrf_token = $_POST['csrf_token'];
+
+// startLog("ajax.csrfToken.php");
+if (!isset($csrf_token)) {
+   header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
+   logExit("csrf_token not set");
+}
+
+if (!array_key_exists('csrf_token',$_SESSION)) {
+   header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
+   logExit("CSRF SESSION Error");
+   exit();
+}
+
+if (!isset($csrf_token) || !isset($_SESSION['csrf_token']) || $csrf_token !== $_SESSION['csrf_token']) {
+   header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
+   logExit("CSRF Token Error");
+   exit();
+}
+
+writeLog("csrf_token: $csrf_token");
+
+
+?>