- improved security against cross-site request forgery (XRSF).

Miguel Barão
1 parent a305bb5d
Showing 4 changed files with 30 additions and 32 deletions Show diff stats
serve.py
static/js/admin.js
templates/admin.html
templates/test.html
@@ -39,7 +39,7 @@ class WebApplication(tornado.web.Application):
             'template_path': path.join(path.dirname(__file__), 'templates'),
             'static_path':   path.join(path.dirname(__file__), 'static'),
             'static_url_prefix': '/static/',
-            'xsrf_cookies': False, # FIXME not needed on private network
+            'xsrf_cookies': True,
             'cookie_secret': base64.b64encode(uuid.uuid4().bytes),
             'login_url': '/login',
             'debug': debug,
@@ -105,7 +105,7 @@ class LogoutHandler(BaseHandler):
 # Based on https://bhch.github.io/posts/2017/12/serving-large-files-with-tornado-safely-without-blocking/
 # ----------------------------------------------------------------------------
 class FileHandler(BaseHandler):
-    chunk_size = 1024 * 1024  # serve up to 1 MiB multiple times
+    chunk_size = 512 * 1024  # serve up to 512 KiB multiple times
     @tornado.web.authenticated
     async def get(self):
+// from:  https://www.tornadoweb.org/en/stable/guide/security.html
+// with changes: removed datatype and callback from original postJSON
+function getCookie(name) {
+    var r = document.cookie.match("\\b" + name + "=([^;]*)\\b");
+    return r ? r[1] : undefined;
+}
+
+jQuery.postJSON = function(url, args) {
+    args._xsrf = getCookie("_xsrf");
+    $.ajax({url: url, data: $.param(args), type: "POST"});
+};
+
+// ---------------------------------------------------------------------------
 $(document).ready(function() {
     function button_handlers() {
         // button handlers (runs once)
@@ -13,28 +26,20 @@ $(document).ready(function() {
         );
         $("#reset_password").click(
             function () {
-                $.ajax({
-                    type: "POST",
-                    url: "/admin",
-                    data: {
-                        "cmd": "reset_password",
-                        "value": $("#reset_number").val()
-                    }
+                $.postJSON("/admin", {
+                    "cmd": "reset_password",
+                    "value": $("#reset_number").val()
                 });
             }
         );
         $("#inserir_novo_aluno").click(
             function () {
-                $.ajax({
-                    type: "POST",
-                    url: "/admin",
-                    data: {
-                        "cmd": "insert_student",
-                        "value": JSON.stringify({
-                            "number": $("#novo_numero").val(),
-                            "name": $("#novo_nome").val()
-                        })
-                    }
+                $.postJSON("/admin", {
+                    "cmd": "insert_student",
+                    "value": JSON.stringify({
+                        "number": $("#novo_numero").val(),
+                        "name": $("#novo_nome").val()
+                    })
                 });
             }
         );
@@ -46,20 +51,12 @@ $(document).ready(function() {
     // checkbox handler to allow/deny students individually
     function autorizeStudent(e) {
         if (this.checked) {
-            $(this).parent().parent().addClass("table-primary"); // row class
-            $.ajax({
-                type: "POST",
-                url: "/admin",
-                data: {"cmd": "allow", "value": this.name}
-            });
+            // $(this).parent().parent().addClass("table-primary"); // row class
+            $.postJSON("/admin", {"cmd": "allow", "value": this.name});
         }
         else {
             // $(this).parent().parent().removeClass("active");
-            $.ajax({
-                type: "POST",
-                url: "/admin",
-                data: {"cmd": "deny", "value": this.name}
-            });
+            $.postJSON("/admin", {"cmd": "deny", "value": this.name});
         }
     }
@@ -24,7 +24,7 @@
     <script defer src="/static/fontawesome.min.js"></script>
     <script defer src="/static/popper.min.js"></script>
     <script defer src="/static/bootstrap/js/bootstrap.min.js"></script>
-    <script type="text/javascript" src="/static/DataTables/datatables.min.js"></script>
+    <script defer src="/static/DataTables/datatables.min.js"></script>
     <script defer src="/static/js/admin.js"></script>
     <script defer src="/static/js/clock.js"></script>
@@ -140,7 +140,6 @@
           <label for="reset_number" class="col-sm-2 col-form-label">Número</label>
           <div class="col-sm-10">
             <input id="reset_number" type="text" class="form-control">
-            <!-- <input type="text" class="form-control" id="novo_numero" value=""> -->
           </div>
         </div>
       </div>
@@ -92,6 +92,8 @@
   </div>
   <form action="/test" method="post" id="test" autocomplete="off">
+    {% module xsrf_form_html() %}
+
     {% for i, q in enumerate(t['questions']) %}
       {% module Template(templ[q['type']], i=i, q=q, md=md(q['ref']), show_ref=t['show_ref']) %}
     {% end %}
	@@ -39,7 +39,7 @@ class WebApplication(tornado.web.Application):		@@ -39,7 +39,7 @@ class WebApplication(tornado.web.Application):
39	'template_path': path.join(path.dirname(__file__), 'templates'),	39	'template_path': path.join(path.dirname(__file__), 'templates'),
40	'static_path': path.join(path.dirname(__file__), 'static'),	40	'static_path': path.join(path.dirname(__file__), 'static'),
41	'static_url_prefix': '/static/',	41	'static_url_prefix': '/static/',
42	- 'xsrf_cookies': False, # FIXME not needed on private network	42	+ 'xsrf_cookies': True,
43	'cookie_secret': base64.b64encode(uuid.uuid4().bytes),	43	'cookie_secret': base64.b64encode(uuid.uuid4().bytes),
44	'login_url': '/login',	44	'login_url': '/login',
45	'debug': debug,	45	'debug': debug,
	@@ -105,7 +105,7 @@ class LogoutHandler(BaseHandler):		@@ -105,7 +105,7 @@ class LogoutHandler(BaseHandler):
105	# Based on https://bhch.github.io/posts/2017/12/serving-large-files-with-tornado-safely-without-blocking/	105	# Based on https://bhch.github.io/posts/2017/12/serving-large-files-with-tornado-safely-without-blocking/
106	# ----------------------------------------------------------------------------	106	# ----------------------------------------------------------------------------
107	class FileHandler(BaseHandler):	107	class FileHandler(BaseHandler):
108	- chunk_size = 1024 * 1024 # serve up to 1 MiB multiple times	108	+ chunk_size = 512 * 1024 # serve up to 512 KiB multiple times
109		109
110	@tornado.web.authenticated	110	@tornado.web.authenticated
111	async def get(self):	111	async def get(self):