From b5f14a1ef742344cd5e885d802ca79a99ad594b4 Mon Sep 17 00:00:00 2001
From: flashwave <me@flash.moe>
Date: Thu, 22 Mar 2018 19:07:02 +0100
Subject: [PATCH] Add temp CSRF functions, for reusage.

---
 public/auth.php        |  2 +-
 src/Application.php    |  1 +
 utility.php            | 20 ++++++++++++++++++++
 views/auth/logout.twig |  2 +-
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/public/auth.php b/public/auth.php
index ba5a1d72..5b6fb636 100644
--- a/public/auth.php
+++ b/public/auth.php
@@ -41,7 +41,7 @@ switch ($mode) {
         }
 
         // this is temporary, don't scream at me for using md5
-        if (isset($_GET['s']) && md5($app->getSession()->session_key) === $_GET['s']) {
+        if (isset($_GET['s']) && tmp_csrf_verify($_GET['s'])) {
             set_cookie_m('uid', '', -3600);
             set_cookie_m('sid', '', -3600);
             $app->getSession()->delete();
diff --git a/src/Application.php b/src/Application.php
index 932a0d59..c1d54380 100644
--- a/src/Application.php
+++ b/src/Application.php
@@ -127,6 +127,7 @@ class Application extends ApplicationBase
         $twig->addFunction('config', [$this->config, 'get']);
         $twig->addFunction('git_hash', [Application::class, 'gitCommitHash']);
         $twig->addFunction('git_branch', [Application::class, 'gitBranch']);
+        $twig->addFunction('csrf_token', 'tmp_csrf_token');
 
         $twig->var('app', $this);
 
diff --git a/utility.php b/utility.php
index 92d49256..a545e8f8 100644
--- a/utility.php
+++ b/utility.php
@@ -130,6 +130,26 @@ function get_country_name(string $code): string
     }
 }
 
+// this is temporary, don't scream at me for using md5
+// BIG TODO: make these functions not dependent on sessions so they can be used outside of those.
+function tmp_csrf_verify(string $token, ?\Misuzu\Users\Session $session = null): bool
+{
+    if ($session === null) {
+        $session = \Misuzu\Application::getInstance()->getSession();
+    }
+
+    return hash_equals(tmp_csrf_token($session), $token);
+}
+
+function tmp_csrf_token(?\Misuzu\Users\Session $session = null): string
+{
+    if ($session === null) {
+        $session = \Misuzu\Application::getInstance()->getSession();
+    }
+
+    return md5($session->session_key);
+}
+
 function is_int_ex($value, int $boundary_low, int $boundary_high): bool
 {
     return is_int($value) && $value >= $boundary_low && $value <= $boundary_high;
diff --git a/views/auth/logout.twig b/views/auth/logout.twig
index 85aa0f9a..33ce34e0 100644
--- a/views/auth/logout.twig
+++ b/views/auth/logout.twig
@@ -7,7 +7,7 @@
             <p class="logout__paragraph">Press the button below to verify the logout request, otherwise click back in your browser or close this tab.</p>
         </div>
         <div class="logout__buttons">
-            <a href="?m=logout&amp;s={{ app.session.session_key|md5 }}" class="button button--logout">Logout</a>
+            <a href="?m=logout&amp;s={{ csrf_token() }}" class="button button--logout">Logout</a>
         </div>
     </div>
 {% endblock %}