From cfce6eb7f279c5d4425610e313a1683f68fae2b9 Mon Sep 17 00:00:00 2001 From: Seamus Lee Date: Fri, 29 Nov 2019 08:33:44 +1100 Subject: [PATCH] security/core#71 Prevent CSRF by ensuring that AJAX endpoint of the API Explorer can only be hit by javascript clinets --- CRM/Api4/Page/AJAX.php | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/CRM/Api4/Page/AJAX.php b/CRM/Api4/Page/AJAX.php index 169340722e..5ec8c56773 100644 --- a/CRM/Api4/Page/AJAX.php +++ b/CRM/Api4/Page/AJAX.php @@ -23,6 +23,27 @@ class CRM_Api4_Page_AJAX extends CRM_Core_Page { * Handler for api4 ajax requests */ public function run() { + $config = CRM_Core_Config::singleton(); + if (!$config->debug && (!array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) || + $_SERVER['HTTP_X_REQUESTED_WITH'] != "XMLHttpRequest" + ) + ) { + $response = [ + 'error_code' => 401, + 'error_message' => "SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api4().", + ]; + Civi::log()->debug( "SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api4().", + [ + 'IP' => $_SERVER['REMOTE_ADDR'], + 'level' => 'security', + 'referer' => $_SERVER['HTTP_REFERER'], + 'reason' => 'CSRF suspected', + ] + ); + CRM_Utils_System::setHttpHeader('Content-Type', 'application/json'); + echo json_encode($response); + CRM_Utils_System::civiExit(); + } try { // Call multiple if (empty($this->urlPath[3])) { -- 2.25.1