Add CSRF protection to remaining commands

main/src/com/google/refine/commands/SetPreferenceCommand.java

@@ -49,6 +49,10 @@ public class SetPreferenceCommand extends Command {
     @Override
     public void doPost(HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {
+    	if(!hasValidCSRFToken(request)) {
+    		respondCSRFError(response);
+    		return;
+    	}
         
         Project project = request.getParameter("project") != null ? getProject(request) : null;
         PreferenceStore ps = project != null ? 

main/src/com/google/refine/commands/row/AnnotateOneRowCommand.java

@@ -50,6 +50,10 @@ public class AnnotateOneRowCommand extends Command {
     @Override
     public void doPost(HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {
+    	if(!hasValidCSRFToken(request)) {
+    		respondCSRFError(response);
+    		return;
+    	}
 
         response.setCharacterEncoding("UTF-8");
         response.setHeader("Content-Type", "application/json");

main/src/com/google/refine/commands/row/DenormalizeCommand.java

@@ -50,6 +50,10 @@ public class DenormalizeCommand extends Command {
     @Override
     public void doPost(HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {
+    	if(!hasValidCSRFToken(request)) {
+    		respondCSRFError(response);
+    		return;
+    	}
         
         try {
             Project project = getProject(request);

main/src/com/google/refine/commands/row/GetRowsCommand.java

@@ -111,6 +111,10 @@ public class GetRowsCommand extends Command {
         }
     }
     
+    /**
+     * This command accepts both POST and GET. It is not CSRF-protected as it does not incur any state change.
+     */
+    
     @Override
     public void doPost(HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {

main/tests/server/src/com/google/refine/commands/SetPreferenceCommandTests.java

@@ -0,0 +1,24 @@
+package com.google.refine.commands;
+
+import com.google.refine.commands.CommandTestBase;
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+public class SetPreferenceCommandTests extends CommandTestBase {
+	
+	@BeforeMethod
+	public void setUpCommand() {
+		command = new SetPreferenceCommand();
+	}
+	
+	@Test
+	public void testCSRFProtection() throws ServletException, IOException {
+		command.doPost(request, response);
+		assertCSRFCheckFailed();
+	}
+}
+

main/tests/server/src/com/google/refine/commands/row/AnnotateOneRowCommandTests.java

@@ -0,0 +1,22 @@
+package com.google.refine.commands.row;
+import com.google.refine.commands.CommandTestBase;
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+public class AnnotateOneRowCommandTests extends CommandTestBase {
+	
+	@BeforeMethod
+	public void setUpCommand() {
+		command = new AnnotateOneRowCommand();
+	}
+	
+	@Test
+	public void testCSRFProtection() throws ServletException, IOException {
+		command.doPost(request, response);
+		assertCSRFCheckFailed();
+	}
+}

main/tests/server/src/com/google/refine/commands/row/DenormalizeCommandTests.java

@@ -0,0 +1,23 @@
+package com.google.refine.commands.row;
+import com.google.refine.commands.CommandTestBase;
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+public class DenormalizeCommandTests extends CommandTestBase {
+	
+	@BeforeMethod
+	public void setUpCommand() {
+		command = new DenormalizeCommand();
+	}
+	
+	@Test
+	public void testCSRFProtection() throws ServletException, IOException {
+		command.doPost(request, response);
+		assertCSRFCheckFailed();
+	}
+}
+

main/webapp/modules/core/scripts/facets/list-facet.js

@@ -721,7 +721,7 @@ ListFacet.prototype._setChoiceCountLimit = function(choiceCount) {
 
     if (!isNaN(n)) {
       var self = this;
-      $.post(
+      Refine.postCSRF(
         "command/core/set-preference",
         {
           name : "ui.browsing.listFacet.limit",

main/webapp/modules/core/scripts/index/lang-settings-ui.js

@@ -28,19 +28,22 @@ Refine.SetLanguageUI = function(elmt) {
   });
 
 	this._elmts.set_lan_btn.bind('click', function(e) {		
-		$.ajax({
+                Refine.wrapCSRF(function(token) {
-			url : "command/core/set-preference?",
+                    $.ajax({
-			type : "POST",
+                            url : "command/core/set-preference?",
-			async : false,
+                            type : "POST",
-			data : {
+                            async : false,
-			  name : "userLang",
+                            data : {
-				value : JSON.stringify($("#langDD option:selected").val())
+                               name : "userLang",
-			},
+                               value : JSON.stringify($("#langDD option:selected").val()),
-			success : function(data) {
+                               csrf_token: token 
-				alert($.i18n('core-index-lang/page-reload'));
+                            },
-				location.reload(true);
+                            success : function(data) {
-			}
+                                    alert($.i18n('core-index-lang/page-reload'));
-		});
+                                    location.reload(true);
+                            }
+                    });
+                });
 	});
 };
 

main/webapp/modules/core/scripts/preferences.js

@@ -78,7 +78,7 @@ function PreferenceUI(tr, key, value) {
       }
       $(td1).text(newValue);
       
-      $.post(
+      Refine.postCSRF(
         "command/core/set-preference",
         {
           name : key,
@@ -96,7 +96,7 @@ function PreferenceUI(tr, key, value) {
 
   $('<button class="button">').text($.i18n('core-index/delete')).appendTo(td2).click(function() {
     if (window.confirm($.i18n('core-index/delete-key')+" " + key + "?")) {
-      $.post(
+      Refine.postCSRF(
         "command/core/set-preference",
         {
           name : key
@@ -154,7 +154,7 @@ function populatePreferences(prefs) {
             value = deDupUserMetaData(value);
         }
         
-        $.post(
+        Refine.postCSRF(
           "command/core/set-preference",
           {
             name : key,

main/webapp/modules/core/scripts/reconciliation/recon-manager.js

@@ -113,17 +113,22 @@ ReconciliationManager.unregisterService = function(service, f) {
 };
 
 ReconciliationManager.save = function(f) {
-  $.ajax({
+  Refine.wrapCSRF(function(token) {
-    async: false,
+    $.ajax({
-    type: "POST",
+        async: false,
-    url: "command/core/set-preference?" + $.param({ 
+        type: "POST",
-      name: "reconciliation.standardServices" 
+        url: "command/core/set-preference?" + $.param({ 
-    }),
+        name: "reconciliation.standardServices" 
-    data: { "value" : JSON.stringify(ReconciliationManager.standardServices) },
+        }),
-    success: function(data) {
+        data: {
-      if (f) { f(); }
+          "value" : JSON.stringify(ReconciliationManager.standardServices), 
-    },
+          csrf_token: token
-    dataType: "json"
+        },
+        success: function(data) {
+        if (f) { f(); }
+        },
+        dataType: "json"
+    });
   });
 };