[postfixadmin/postfixadmin] 8a1f9a: CSRF protection - support multiple tokens (#985)

[David G. <no...@gi...>]

  Branch: refs/heads/master
  Home:   https://github.com/postfixadmin/postfixadmin
  Commit: 8a1f9a11af69f440d0bcfff87e75c2f3d69dd1d6
      https://github.com/postfixadmin/postfixadmin/commit/8a1f9a11af69f440d0bcfff87e75c2f3d69dd1d6
  Author: David Goodwin <da...@co...>
  Date:   2026-03-01 (Sun, 01 Mar 2026)

  Changed paths:
    M common.php
    M composer.json
    M functions.inc.php
    M model/AdminpasswordHandler.php
    A model/CsrfInvalidException.php
    A model/CsrfToken.php
    M model/Languages.php
    M model/Login.php
    M model/PFASmarty.php
    M psalm.xml
    M public/backup.php
    M public/broadcast-message.php
    M public/common.php
    M public/delete.php
    M public/edit.php
    M public/editactive.php
    M public/list-virtual.php
    M public/list.php
    M public/login-mfa.php
    M public/login.php
    M public/sendmail.php
    M public/users/app-passwords.php
    M public/users/edit-alias.php
    M public/users/login-mfa.php
    M public/users/login.php
    M public/users/password-change.php
    M public/users/password-recover.php
    M public/users/password.php
    M public/users/totp-exceptions.php
    M public/users/totp.php
    M public/vacation.php
    M public/viewlog.php
    M templates/app-passwords.tpl
    M templates/backupwarning.tpl
    M templates/broadcast-message.tpl
    M templates/editform.tpl
    M templates/list-virtual_mailbox.tpl
    M templates/list.tpl
    M templates/login-mfa.tpl
    M templates/login.tpl
    M templates/password-change.tpl
    M templates/password.tpl
    M templates/sendmail.tpl
    M templates/totp-exceptions.tpl
    M templates/totp.tpl
    M templates/users_edit-alias.tpl
    M templates/vacation.tpl
    A tests/CsrfTokenTest.php

  Log Message:
  -----------
  CSRF protection - support multiple tokens  (#985)

possible fix for https://github.com/postfixadmin/postfixadmin/issues/967

CSRF Token changes : rather than have one PFA_Token value in $_SESSION, store a list of them, where each value has a time stamp it was issued on. The aim is to allow the user to have multiple browser tabs open at once - and not have the last tab that loaded trample on others. Tokens expire after 1 hour.

Adds a Smarty helper function `{CSRF_Token}` which will output `<input type=hidden name=CSRF_Token value=asdf123>` or `{CSRF_Token type=url}` which outputs a literal string like 'asdf123' suitable for placing in a URL.

Adds a PHP exception handler in public/common.php, which could be used to display a more friendly error message/response (but at the moment is fairly minimal).

Removes most uses of `die()` within the codebase, and instead moves to throw an exception



To unsubscribe from these emails, change your notification settings at https://github.com/postfixadmin/postfixadmin/settings/notifications