[SECURITY] Added CSRF protection to form

Author: derhansen

Classes/Controller/PasswordController.php

@@ -56,7 +56,7 @@ public function editAction()
     public function initializeUpdateAction()
     {
         $changePasswordArray = $this->request->getArgument('changePassword');
-        $changeHmac = $changePasswordArray['changeHmac'] ? $changePasswordArray['changeHmac'] : '';
+        $changeHmac = $changePasswordArray['changeHmac'] ? (string)$changePasswordArray['changeHmac'] : '';
         if (!$this->frontendUserService->validateChangeHmac($changeHmac)) {
             throw new \TYPO3\CMS\Extbase\Security\Exception\InvalidHashException(
                 'Possible CSRF detected. Ensure a valid "changeHmac" is provided.',

Classes/Domain/Model/Dto/ChangePassword.php

@@ -85,7 +85,7 @@ public function setCurrentPassword(string $currentPassword)
     /**
      * @return string
      */
-    public function getChangeHmac()
+    public function getChangeHmac(): string
     {
         return $this->changeHmac;
     }

Classes/Exception/InvalidUserException.php

@@ -0,0 +1,12 @@
+<?php
+declare(strict_types=1);
+namespace Derhansen\FeChangePwd\Service;
+
+use Exception;
+
+/**
+ * Invalid user exception
+ */
+class InvalidUserException extends Exception
+{
+}

Classes/Service/FrontendUserService.php

@@ -116,14 +116,19 @@ public function updatePassword(string $newPassword)
      *
      * @return string
      */
-    public function getChangeHmac()
+    public function getChangeHmac(): string
     {
         if (!$this->isUserLoggedIn()) {
             return '';
         }
 
         $userUid = $this->getFrontendUser()->user['uid'];
-        return GeneralUtility::hmac('fe_user_' . $userUid, 'fe_change_pwd');
+        if (!is_int($userUid) || (int)$userUid <= 0) {
+            throw new InvalidUserException('The fe_user uid is not a positive number.', 1574102778917);
+        }
+
+        $tstamp = $this->getFrontendUser()->user['tstamp'];
+        return GeneralUtility::hmac('fe_user_' . $userUid . '_' . $tstamp, 'fe_change_pwd');
     }
 
     /**
@@ -132,13 +137,9 @@ public function getChangeHmac()
      * @param string $changeHmac
      * @return bool
      */
-    public function validateChangeHmac($changeHmac)
+    public function validateChangeHmac(string $changeHmac): bool
     {
-        if ($changeHmac !== '' && $changeHmac === $this->getChangeHmac()) {
-            return true;
-        } else {
-            return false;
-        }
+        return is_string($changeHmac) && $changeHmac !== '' && hash_equals($this->getChangeHmac(), $changeHmac);
     }
 
     /**