From a0a8490e3d7cb6a6e6c8c1c8216183a43c9b3723 Mon Sep 17 00:00:00 2001 From: santichausis Date: Mon, 6 Jul 2026 00:38:42 -0300 Subject: [PATCH] Require admin authentication on /scripts/ database-write endpoints These are internal data-migration/admin tools (ecobrick and training processing, DB delete of training records) with no link from any public page or JS, yet were reachable by anyone who found the URL and would execute INSERT/UPDATE/DELETE against the GoBrik database with no auth check at all. Adds includes/require-admin.php, a shared gate that checks a token (?admin_token=... or POST field) against a secret defined in a new admin_env.php file at the repo root -- not committed, following the same convention as ecobricks_env.php/gobrikconn_env.php. Once validated, the token is remembered in the session so the existing multi-step migration flows (these scripts redirect to each other) don't need to re-authenticate every request. Left untouched: carbon_check.php (fetched directly by public JS, js/website-carbon-badges.js) and the read-only ajax-*/get-*/ training-detail.php/ssp.class.php scripts, which mirror the site's public "Open Books" transparency APIs under /api/ and aren't referenced in the reported vulnerability. --- includes/require-admin.php | 40 +++++++++++++++++++++++ scripts/process_ecobrick-full.php | 1 + scripts/process_ecobrick-old.php | 2 +- scripts/process_ecobrick.php | 1 + scripts/process_ecobrick_for_maker_id.php | 2 +- scripts/process_training.php | 1 + scripts/process_training2.php | 2 +- scripts/process_training3.php | 1 + scripts/training.php | 1 + scripts/update-training-database.php | 1 + 10 files changed, 49 insertions(+), 3 deletions(-) create mode 100644 includes/require-admin.php diff --git a/includes/require-admin.php b/includes/require-admin.php new file mode 100644 index 000000000..883d1a29a --- /dev/null +++ b/includes/require-admin.php @@ -0,0 +1,40 @@ + diff --git a/scripts/process_ecobrick-old.php b/scripts/process_ecobrick-old.php index 2c991dbec..7f5c50113 100644 --- a/scripts/process_ecobrick-old.php +++ b/scripts/process_ecobrick-old.php @@ -1,4 +1,4 @@ - + diff --git a/scripts/process_ecobrick.php b/scripts/process_ecobrick.php index e60f8bc79..18952f047 100644 --- a/scripts/process_ecobrick.php +++ b/scripts/process_ecobrick.php @@ -1,3 +1,4 @@ + diff --git a/scripts/process_ecobrick_for_maker_id.php b/scripts/process_ecobrick_for_maker_id.php index 2c5328bff..16dd77bed 100644 --- a/scripts/process_ecobrick_for_maker_id.php +++ b/scripts/process_ecobrick_for_maker_id.php @@ -1,4 +1,4 @@ - + diff --git a/scripts/process_training.php b/scripts/process_training.php index 17c3b0ccd..6a9b5658c 100644 --- a/scripts/process_training.php +++ b/scripts/process_training.php @@ -2,6 +2,7 @@ // PART 1 of the code // process_training.php +require_once '../includes/require-admin.php'; include '../ecobricks_env.php'; // Knack API settings diff --git a/scripts/process_training2.php b/scripts/process_training2.php index c0e76db54..8b12265d3 100644 --- a/scripts/process_training2.php +++ b/scripts/process_training2.php @@ -1,8 +1,8 @@ -