csrf protection in a search function

Site Admin Joined: Aug 22, 2007 Posts: 1772

I'm trying to build a search-function and i have little bit played with the csrf protection methods. I have a pager function, that pass the needed stuff with hyperlinks (GET) into my functions. I thought it could be cool to protect the search query before i pass it back into my function.

Code:

if (!isset($search)) $search = '';


if (!isset($go)) $go = '';


if (!isset($offset)) $offset = '';





switch($op) {





   case 'search':


   search($offset, $go, $search);


   break;





}





function search($offset, $go, $search) {


   global $db, $prefix, $op, $module_name;


   if ($search != '') {


      csrf_check();


      define('paranoid_search', true);


   }


   $path = 'modules.php?name=' . $module_name . '&amp;op=' . $op;


   include_once 'header.php';


   OpenTable();


   echo '<div class="text-center">' , PHP_EOL


      , '<form method="post" action="modules.php?name=' , $module_name , '&amp;op=' , $op , '">' , PHP_EOL


      , '<input type="text" name="search" />&nbsp;' , PHP_EOL


      , '<input type="submit" value="' , _SEARCH , '" />' , PHP_EOL


      , '</form>' , PHP_EOL


      , '</div>' , PHP_EOL;


   $search_filter = $db->sql_escape_string(check_html($search,'nohtml'));


   $query = 'SELECT `title` FROM `' . $prefix . '_mytable` WHERE `title` LIKE \'%' . $search_filter . '%\' ORDER BY `id` ASC';


   pager($path, $offset, $go);


   CloseTable();


   include_once 'footer.php';


}





function pager($path, $offset, $go) {


   if (defined('paranoid_search')) {


      $token = 'class="rn_csrf" ';


   } else {


      $token = '';


   }


   echo '<a ' , $token , 'href="' , $path , '&amp;offset=' , $offset , '&amp;go=' , $go , '">1</a>' , PHP_EOL;


}

Yes ok, in this case i get a very long url as result in the pager hyperlink but the search function should be used only by logged users.
Is it to paranoid to do this or give it a better way to ride on the token?

Posted: Sun May 12, 2013 12:09 pm

I would say that this is probably "paranoid". The reason i say this is that typical xss protection is to stop the submission of data that if accepted would be saved or change something. And since this is just displaying data ....

If you want to protect links this is the only way. I guys you could use a cookie to store the token and then pass it back to the proper functions (not csrf_check()). You would have to review csrf-magic.php.

Posted: Sun May 12, 2013 12:21 pm

Ok i understand, thank you for the reply.