Commit 942ad596 authored by Mahesh Patil's avatar Mahesh Patil
Browse files

[rtub] Fix Security Issues.

parent e62f7c70

README.MD

+1 −1
Original line number Diff line number Diff line
@@ -18,7 +18,7 @@ User Logout and User Nodeview events and also store 
these event data in your database. This data is then exposed to views

so you can report on it if required.



Note: Front Page/Home Page be tracked by default.

Note:We do not track Front Page/Home Page.

We dont track Node view event for anonymous user.

rtub.module

+17 −3
Original line number Diff line number Diff line
@@ -98,12 +98,26 @@ function rtub_preprocess_node(&$variables) { 
  if (!(\Drupal::service('path.matcher')->isFrontPage())) {

    // Do not track front page.

    $variables['#attached']['library'][] = 'rtub/rtub-js';

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventData'] = "User on " . $node->getTitle();

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventData'] = $node->getTitle();

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventType'] = "nodeview";



    $str = "User on " . $node->getTitle() . " | nodeview";

    $eStr = Crypt::hmacBase64(_get_cript_data($node->getTitle(), 'nodeview'), Settings::getHashSalt());



    $eStr = Crypt::hmacBase64($str, Settings::getHashSalt());

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventToken'] = $eStr;

  }

}



/**

 * Returns data for "hmacBase64".

 *

 * @param string $title

 *   Node title.

 * @param string $type

 *   Event type.

 *

 * @return string

 *   return string.

 */

function _get_cript_data($title, $type) {

  return "User on {$title} | {$type}";

}

src/Controller/PostNodeDataController.php

+5 −4
Original line number Diff line number Diff line
@@ -86,9 +86,10 @@ class PostNodeDataController extends ControllerBase { 
    if ($this->currentUser()->isAnonymous()) {

      throw new AccessDeniedHttpException();

    }



    $event = $request->request->get('event');

    $newStr = $event['eData'] . "|" . $event['eType'];

    $title = $event['eData'];

    $type = $event['eType'];

    $newStr = "User on {$title} | {$type}";

    $eStr = Crypt::hmacBase64($newStr, Settings::getHashSalt());



    if ($event['eToken'] == $eStr) {
@@ -97,9 +98,9 @@ class PostNodeDataController extends ControllerBase { 
      $connection->insert('rtub')

        ->fields([

          'uid' => $this->currentUser()->id(),

          'event_type' => $event['eType'],

          'event_type' => $type,

          'event_timestamp' => $this->time->getRequestTime(),

          'event_data' => $event['eData'],

          'event_data' => "User on {$title} Page",

        ])->execute();



      $response['status'] = TRUE;