From a3c0243772142ba3a516ca9d74d83ee701673cd1 Mon Sep 17 00:00:00 2001 From: Matt Pass Date: Fri, 18 Apr 2014 17:57:54 +0100 Subject: [PATCH] Include headers lib & csrf hidden form field To help protect against CSRF and clickjacking Also include hidden form field containing this for postback top.ICEcoder.csrf also set --- editor.php | 7 +++++-- files.php | 5 ++++- index.php | 10 ++++++++-- lib/bug-files-check.php | 1 + lib/download.php | 4 +++- lib/get-branch.php | 1 + lib/help.php | 5 ++++- lib/login.php | 2 ++ lib/multiple-results.php | 5 ++++- lib/plugins-display.php | 2 ++ lib/properties.php | 6 +++++- lib/settings-screen.php | 6 +++++- lib/updater.php | 5 ++++- 13 files changed, 48 insertions(+), 11 deletions(-) diff --git a/editor.php b/editor.php index 086c3d4..cb56506 100644 --- a/editor.php +++ b/editor.php @@ -1,4 +1,7 @@ - + @@ -315,4 +318,4 @@ var debounce; - + \ No newline at end of file diff --git a/files.php b/files.php index 9bd854e..d71dbf8 100644 --- a/files.php +++ b/files.php @@ -1,4 +1,7 @@ - + diff --git a/index.php b/index.php index f1b99f6..642c081 100644 --- a/index.php +++ b/index.php @@ -1,4 +1,6 @@ -;ICEcoder.init();top.ICEcoder.content.style.visibility='visible';top.ICEcoder.filesFrame.contentWindow.frames['processControl'].location.href = 'processes/on-load.php';" onResize="ICEcoder.setLayout()" onKeyDown="return ICEcoder.interceptKeys('coder',event);" onKeyUp="parent.ICEcoder.resetKeys(event);" onBlur="parent.ICEcoder.resetKeys(event);">
@@ -109,6 +112,7 @@ Color picker">Co <input type= + ">
@@ -248,6 +252,7 @@ Color picker">Co <input type=
+ ">
@@ -257,6 +262,7 @@ Color picker">Co <div class=Go to Line
+ ">
diff --git a/lib/bug-files-check.php b/lib/bug-files-check.php index 34abfb4..76f9a9b 100644 --- a/lib/bug-files-check.php +++ b/lib/bug-files-check.php @@ -1,5 +1,6 @@ + diff --git a/lib/login.php b/lib/login.php index 17e2b4d..55a3c2e 100644 --- a/lib/login.php +++ b/lib/login.php @@ -1,4 +1,5 @@ @@ -32,6 +33,7 @@ echo $ICEcoder["password"] == "" && !$ICEcoder["multiUser"] ? "Setup" : "Login"; } if (!$ICEcoder["multiUser"]) { echo '
multi-user?
';}; ?> + "> diff --git a/lib/multiple-results.php b/lib/multiple-results.php index b5e8136..3fb8877 100644 --- a/lib/multiple-results.php +++ b/lib/multiple-results.php @@ -1,4 +1,7 @@ - + + @@ -85,6 +88,7 @@ $execVars = array(1,3,5,7); Change to:
+">
diff --git a/lib/settings-screen.php b/lib/settings-screen.php index 8e9ad4d..3f7f996 100644 --- a/lib/settings-screen.php +++ b/lib/settings-screen.php @@ -1,4 +1,7 @@ - + @@ -268,6 +271,7 @@ var validatePasswords = function() { +"> diff --git a/lib/updater.php b/lib/updater.php index 7830e2b..3726009 100644 --- a/lib/updater.php +++ b/lib/updater.php @@ -1,4 +1,7 @@ - + Updating ICEcoder...