Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.

publish/addeditor.php

@@ -4,9 +4,12 @@ if ( ! isset($_SERVER['HTTPS'])) {
 }
 require_once("../session.lib.php"); 
 $added = FALSE;
+$csrf_failed = FALSE;
 if (!isset($_SESSION['editor'])) {
   header("Location: https://xxx.org.za/publish/login");
   return;
+} else if (isset($_POST['adduser']) && !csrf_valid()) {
+  $csrf_failed = TRUE;
 } else if (isset($_POST['adduser'])) {
   require_once('../open_db.lib.php');
   open_db('open');
@@ -48,8 +51,12 @@ if (!isset($_SESSION['editor'])) {
 <?php if ($added) { ?>
   <p>Added editor <?= form_value($username) ?></p>
 <?php } else { ?>
+<?php if ($csrf_failed) { ?>
+  <p><strong>Your session has expired. Please try again.</strong></p>
+<?php } ?>
 
 <form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
+  <?= csrf_field() ?>
   <div class="grid">
 
     <label for="username">Username: </label>

publish/edit.php

@@ -77,6 +77,11 @@ if (isset($_POST['action'])) {
 if (!isset($action) && $id) {
   $action = 'edit';
 }
+// A POST without a valid CSRF token only gets a preview
+if (isset($_POST['action']) && !csrf_valid()) {
+  $validate['csrf'] = 'Your session has expired. Please check the story, then send it again.';
+  $action = 'preview';
+}
 
 switch ($action) {
   case 'submit':    // to queue

publish/index.php

@@ -64,6 +64,12 @@ if (isset($_POST['action']))
 else
   $action = NULL;
 
+// A POST without a valid CSRF token only gets a preview
+if ($action && !csrf_valid()) {
+  $validate['csrf'] = 'Your session has expired. Please check your story, then send it again.';
+  $action = 'preview';
+}
+
 switch ($action) {
   case 'post':      // post to database
   case 'save':    // post to queue

publish/login.php

@@ -9,6 +9,8 @@ if (isset($_SESSION['editor'])) {
   session_write_close();
   header("Location: https://xxx.org.za/publish/edit");
   return;
+} else if (isset($_POST['login']) && !csrf_valid()) {
+  $denied = TRUE;
 } else if (isset($_POST['login'])) {
   include_once('../open_db.lib.php');
   $table = "editors";
@@ -80,6 +82,7 @@ if ($denied)
 ?>
 
 <form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
+  <?= csrf_field() ?>
   <div class="grid">
 
     <label for="username">Username: </label>

publish/logout.php

@@ -7,6 +7,11 @@ include_once('../session.lib.php');
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
+// Only log out from our own logout link, which carries the CSRF token
+if (!csrf_valid($_GET['token'] ?? '')) {
+  header("Location: https://xxx.org.za/");
+  exit;
+}
 if (isset($_SESSION['editor'])) {
   if (isset($_COOKIE[session_name()])) {
     setcookie(session_name(), '', strtotime('-1 day'), '/');

publish/write.inc.php

@@ -21,6 +21,7 @@ if (count($validate) !== 0) {
 ?>
 
 <form id="write" method="post" enctype="multipart/form-data" onsubmit="return review()" action="">
+<?= csrf_field() ?>
 
 <div class="grid">