Warning::
Before you do this mod, be sure to do the "Upgrading Cookie Security (UpDate 1 of 2)" first, for this mod requires a "sessions" to be started which in that mod, I had put that into the mainfile.php.

What is this:
To enhance security for both user and admin logins on the website, I added CSRF token protection. CSRF stands for Cross-Site Request Forgery, which is a type of attack where someone tricks your browser into performing actions (like submitting a form or logging in) without your consent. This can lead to unauthorized actions on your account.

To stop these kinds of attacks, we implemented a system that uses CSRF token, a unique, one-time-use codes that verify if a request is genuinely coming from the right source (the person who owns the session). These tokens are generated, stored in a session, and checked with each form submission. If the token isn’t valid, the action won’t be processed.

I built three easy-to-use functions that make adding CSRF protection to mods in which you think it should be simple to add. These functions should be used with forms that need to be protected.

The Three Functions

1. generateCsrfToken()
   This function creates a unique token (if one doesn’t already exist) and stores it in the user’s session. The token is unique for each user and ensures that every request can be verified.
   
   • Why? The token is like a secret handshake between the server and the browser. If the handshake doesn’t match, the request is ignored.
     
   
   
2. validateCsrfToken($token)
   This function checks if the token provided with the form submission matches the one stored in the session. If they match, the request is valid.
   
   • Why? This step ensures that only legitimate requests are processed. If the token doesn’t match, the server blocks the request, protecting the site from malicious actions.
     
   
   
3. csrfInputField()
   This function generates a hidden input field with the CSRF token. It’s designed to make it easy to add the token to any form. Just echo the function inside your form’s HTML, and it will include the token automatically.
   
   • Why? Without this hidden input, the CSRF token wouldn’t be sent with the form, making validation impossible. This function streamlines the process so developers don’t have to write repetitive code.
     

How to Use These Functions in Your Evo Xtreme CMS Mod
Adding CSRF protection to a mod is simple with these functions.

1. Include the CSRF token in your form:
   Inside your form, add this line where you want the hidden CSRF token field:
   
   

   Code: [ Select all ]

   echo csrfInputField();
   
   This will automatically generate and include the token. If the forum already has a few hidden fields, i tend to put this with them, if not, I do it before the submit button. It is just another form field that is hidden, and can only be see when fiew source.
   
   
2. Validate the CSRF token when processing the form:
   In your form processing code, validate the token like this:
   
   

   Code: [ Select all ]

   if (!validateCsrfToken($_POST['csrf_token'])) {
   
       die('Invalid CSRF token. Request rejected.');
   
   }
   
   
   If the token is invalid, the server will reject the request.
   

Best way to implement this is to treat it as if its a captcha that is going to pass or fail. It works, (implementation wise), the same.

Why This is Important
CSRF attacks can happen silently, often without the user realizing their account has been compromised. By implementing CSRF token protection, we’ve added an extra layer of defense that ensures only the rightful user can submit forms or perform actions on their account.

This protection is now available for both user logins and admin logins, but it can also be used for any other forms or mods on the site. With these reusable functions, developers can quickly secure their mods without having to reinvent the wheel.


How To Install:
Attached are two file,

1. CSRF_Token_Protection--Manual - This here of course is like the Cookie edits, but this is the manual edits for you to go in and edit the files yourself. Be sure to make backups of everything first before doing this.
   
   
2. CSRF_Token_Protection--File - These here are the pre edit files. If you have not edited any of the below files AND you have already done the cookie edits from this post: [Security Update] Upgrading Cookie Security (UpDate 1 of 2)
   
   
   • admin.php  *
     
   • admin/functions.php
     
   • includes/functions_evo.php
     
   • includes/usercp_register.php
     
   • modules/Evo_Userblock/addons/login.php
     
   • modules/Your_Account/includes/functions.php  *
     
   
   Note: Any file marked with a *, if you did the cookie update, then you can still use the pre-edited files.
   Those edits are already in this. If you didn't do the cookie update, then do that first before this.

Now, just choose which one you want to use and download it and follow the instructions within the zip file.

Okay, this post is for those theme develpers that do a seperate login model like I have on my site, or is used on the RD-GenasiICE themes that are available in the theme selector on this site. If you have a login model where if they click "Login" on your site and instead of taking you to the Your_Account, a lightbox model popsup with the login, you may need to add in the scrf_token for some are using it and some arn't atm. It will be default in the next release, but for now, what you can do is if the function exist, then it will use the code, if not, then it wont. To do that, in the popup model, where you would put in the gfxcheck for the recaptcha, under that, you just need to put in this:



So, in all, it shoudl look something like this:



I hope this helps a bit.

For those that are installing this on your site and you need to edit your theme, this is what you would need to do IF your theme has it's own login model/page.

You don't have these files ready because I've tried editing them several times and I can't. My site keeps going offline due to an error.

help......            

— samueljd wrote

You don't have these files ready because I've tried editing them several times and I can't. My site keeps going offline due to an error.

help......            

First post, I do have pre-edited files available. Just like the first update, which is required to have installed before this one.
I do recommend editing the files yourself, but, if your site is a new site without many modifications, then the pre-edited files are just fine.