From ddefc2aafa5571ae7517e48d27df1b49004d5eec Mon Sep 17 00:00:00 2001
From: b3yond <b3yond@riseup.net>
Date: Sun, 27 Jan 2019 14:52:42 +0100
Subject: [PATCH] write and read CSRF cookie

---
 frontend.py | 9 +++++++++
 session.py  | 9 ++++++++-
 user.py     | 4 ++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/frontend.py b/frontend.py
index 452769f..53e3097 100755
--- a/frontend.py
+++ b/frontend.py
@@ -144,6 +144,7 @@ def settings(user):
 
 
 @post('/settings/markdown')
+#csrf
 @view('template/settings.tpl')
 def update_markdown(user):
     user.set_markdown(request.forms['markdown'])
@@ -151,6 +152,7 @@ def update_markdown(user):
 
 
 @post('/settings/mail_md')
+#csrf
 @view('template/settings.tpl')
 def update_mail_md(user):
     user.set_mail_md(request.forms['mail_md'])
@@ -158,6 +160,7 @@ def update_mail_md(user):
 
 
 @post('/settings/goodlist')
+#csrf
 @view('template/settings.tpl')
 def update_trigger_patterns(user):
     user.set_trigger_words(request.forms['goodlist'])
@@ -165,6 +168,7 @@ def update_trigger_patterns(user):
 
 
 @post('/settings/blocklist')
+#csrf
 @view('template/settings.tpl')
 def update_badwords(user):
     user.set_badwords(request.forms['blocklist'])
@@ -172,6 +176,7 @@ def update_badwords(user):
 
 
 @post('/settings/telegram')
+#csrf
 def register_telegram(user):
     apikey = request.forms['apikey']
     user.update_telegram_key(apikey)
@@ -179,6 +184,7 @@ def register_telegram(user):
 
 
 @get('/api/state')
+#csrf
 def api_enable(user):
     return user.state()
 
@@ -198,6 +204,8 @@ def logout():
     # clear auth cookie
     response.set_cookie('uid', '', expires=0, path="/")
     # :todo show info "Logout successful."
+    allchar = "1234567890"
+    response.set_cookie('csrf', '', expires=0, path="/")
     redirect('/')
 
 
@@ -240,6 +248,7 @@ def twitter_callback(user):
 
 
 @post('/login/mastodon')
+#csrf
 def login_mastodon(user):
     """
     Mastodon OAuth authentication process.
diff --git a/session.py b/session.py
index b361604..f51dbce 100644
--- a/session.py
+++ b/session.py
@@ -1,4 +1,4 @@
-from bottle import redirect, request
+from bottle import redirect, request, abort, response
 from db import db
 from functools import wraps
 from inspect import Signature
@@ -21,6 +21,13 @@ class SessionPlugin(object):
                 if uid is None:
                     return redirect(self.loginpage)
                 kwargs[self.keyword] = User(uid)
+                csrf = None  # initialize variable
+                if request.method == 'POST':
+                    csrf = request.form.get('csrf')
+                elif request.method == 'GET':
+                    csrf = request.args.get('csrf')
+                if csrf != request.get_cookie('csrf'):
+                        abort(400)
                 return callback(*args, **kwargs)
 
             return wrapper
diff --git a/user.py b/user.py
index 92eb463..43d9050 100644
--- a/user.py
+++ b/user.py
@@ -4,12 +4,16 @@ from db import db
 import jwt
 from mastodon import Mastodon
 from pylibscrypt import scrypt_mcf, scrypt_mcf_check
+from random import choice
 
 
 class User(object):
     def __init__(self, uid):
         # set cookie
         response.set_cookie('uid', uid, secret=db.get_secret(), path='/')
+        allchar = "1234567890"
+        response.set_cookie('csrf', "".join(choice(allchar) for x in [32]),
+                            db.get_secret(), path='/')
         self.uid = uid
 
     def check_password(self, password):