From 93e441e821e8154193ed52e97bc4d43c96efc206 Mon Sep 17 00:00:00 2001 From: Jonas Lochmann Date: Mon, 13 Jan 2020 00:00:00 +0000 Subject: [PATCH] Add simple CSRF protection for the admin API --- src/api/admin.ts | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/src/api/admin.ts b/src/api/admin.ts index 5db233c..d3140ff 100644 --- a/src/api/admin.ts +++ b/src/api/admin.ts @@ -18,11 +18,11 @@ import { urlencoded } from 'body-parser' import * as escape from 'escape-html' import { Router } from 'express' -import { BadRequest, Conflict } from 'http-errors' +import { BadRequest, Conflict, Forbidden } from 'http-errors' import { Database } from '../database' import { addPurchase } from '../function/purchase' import { getStatusMessage, setStatusMessage } from '../function/statusmessage' -import { generatePurchaseId } from '../util/token' +import { generateAuthToken, generatePurchaseId } from '../util/token' import { WebsocketApi } from '../websocket' export const createAdminRouter = ({ database, websocket }: { @@ -31,6 +31,8 @@ export const createAdminRouter = ({ database, websocket }: { }) => { const router = Router() + const serverToken = generateAuthToken() + router.get('/', (_, res) => { res.send('status
Status message
unlock premium') }) @@ -45,7 +47,7 @@ export const createAdminRouter = ({ database, websocket }: { try { const currentStatusMessage = await getStatusMessage({ database }) - res.send('
') + res.send('
') } catch (ex) { next(ex) } @@ -53,10 +55,14 @@ export const createAdminRouter = ({ database, websocket }: { router.post('/status-message', urlencoded({ extended: false }), async (req, res, next) => { try { - if (typeof req.body !== 'object' || typeof req.body.smessage !== 'string') { + if (typeof req.body !== 'object' || typeof req.body.smessage !== 'string' || typeof req.body.token !== 'string') { throw new BadRequest() } + if (req.body.token !== serverToken) { + throw new Forbidden() + } + const newStatusMessage = req.body.smessage as string await setStatusMessage({ database, newStatusMessage }) @@ -70,15 +76,19 @@ export const createAdminRouter = ({ database, websocket }: { }) router.get('/unlock-premium', (_, res) => ( - res.send('
mail:
Month
Year
') + res.send('
mail:
Month
Year
') )) router.post('/unlock-premium', urlencoded({ extended: false }), async (req, res, next) => { try { - if (typeof req.body !== 'object' || typeof req.body.mail !== 'string' || typeof req.body.duration !== 'string') { + if (typeof req.body !== 'object' || typeof req.body.mail !== 'string' || typeof req.body.duration !== 'string' || typeof req.body.token !== 'string') { throw new BadRequest() } + if (req.body.token !== serverToken) { + throw new Forbidden() + } + const mail: string = req.body.mail const type: string = req.body.duration