harmacist/vichan
1
0
Fork 0
forked from GithubBackups/vichan
Code Pull Requests Activity

SECURITY: Poster IDs could reveal IPs across boards

Browse Source 
Imagine the following scenario:

Alice has permission to view IPs on board A, and Bob has permissions to view IPs on board B.

If the post number was to match, and the same IP made both posts, A and B could trade user IPs which they wouldn't normally have permission to do so. This weird bug has already creeped up on 8chan.co and is now patched.
This commit is contained in:
8chan 2014-10-07 08:16:21 -07:00
parent 9468df05b9
commit 3da946268a
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
inc/functions.php
View File

@ -2138,14 +2138,14 @@ function rrmdir($dir) {
}
}
function poster_id($ip, $thread) {
function poster_id($ip, $thread, $board) {
global $config;
if ($id = event('poster-id', $ip, $thread))
if ($id = event('poster-id', $ip, $thread, $board))
return $id;
// Confusing, hard to brute-force, but simple algorithm
return substr(sha1(sha1($ip . $config['secure_trip_salt'] . $thread) . $config['secure_trip_salt']), 0, $config['poster_id_length']);
return substr(sha1(sha1($ip . $config['secure_trip_salt'] . $thread . $board) . $config['secure_trip_salt']), 0, $config['poster_id_length']);
}
function generate_tripcode($name) {

2
inc/lib/Twig/Extensions/Extension/Tinyboard.php
View File

@ -19,7 +19,6 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension
new Twig_SimpleFilter('capcode', 'capcode'),
new Twig_SimpleFilter('hasPermission', 'twig_hasPermission_filter'),
new Twig_SimpleFilter('date', 'twig_date_filter'),
new Twig_SimpleFilter('poster_id', 'poster_id'),
new Twig_SimpleFilter('remove_whitespace', 'twig_remove_whitespace_filter'),
new Twig_SimpleFilter('count', 'count'),
new Twig_SimpleFilter('ago', 'ago'),
@ -40,6 +39,7 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension
return array(
new Twig_SimpleFunction('time', 'time'),
new Twig_SimpleFunction('floor', 'floor'),
new Twig_SimpleFunction('poster_id', 'poster_id'),
new Twig_SimpleFunction('timezone', 'twig_timezone_function'),
new Twig_SimpleFunction('hiddenInputs', 'hiddenInputs'),
new Twig_SimpleFunction('hiddenInputsHash', 'hiddenInputsHash'),

4
templates/post/poster_id.html
View File

@ -1,7 +1,7 @@
{% if config.poster_ids %}
{% if post.thread %}
ID: <span class="poster_id">{{ post.ip|poster_id(post.thread) }}</span>
ID: <span class="poster_id">{{ poster_id(post.ip, post.thread, board.uri) }}</span>
{% else %}
ID: <span class="poster_id">{{ post.ip|poster_id(post.id) }}</span>
ID: <span class="poster_id">{{ poster_id(post.ip, post.id, board.uri) }}</span>
{% endif %}
{% endif %}