Add Phase 1 progress documentation and Task 9 quick-start guide

- PHASE_1_PROGRESS.md: Comprehensive progress report (66% complete) - Documents all 7 completed security tasks - Lists remaining 4 tasks with estimates - Security improvements summary - Database changes required - Files modified and testing verification - TASK_9_ADD_CSRF_FORMS.md: Quick-start guide for adding CSRF tokens - Step-by-step instructions for form modification - List of ~40 forms that need tokens (prioritized) - Common patterns and examples - Validation reference - Troubleshooting guide - Testing checklist Ready for Task 9 implementation (form template updates)
2025-12-03 11:31:09 +02:00
parent 1ef4d06627
commit ce6c8e257a
2 changed files with 549 additions and 0 deletions
--- a/PHASE_1_PROGRESS.md
+++ b/PHASE_1_PROGRESS.md
@@ -0,0 +1,343 @@
+# Phase 1 Implementation Progress - Security & Stability
+
+**Status**: 66% Complete (7 of 11 tasks)  
+**Date Started**: 2025-12-03  
+**Branch**: `feature/site-cleanup`
+
+---
+
+## Completed Tasks ✅
+
+### 1. CSRF Token System (100% Complete)
+**File**: `functions.php`
+- ✅ `generateCSRFToken()` - Generates random 64-char hex tokens, stored in `$_SESSION['csrf_tokens']` with 1-hour expiration
+- ✅ `validateCSRFToken()` - Single-use validation, removes token after successful validation
+- ✅ `cleanupExpiredTokens()` - Automatic cleanup of expired tokens from session
+- **Usage**: Token is now required in all POST requests via `csrf_token` hidden form field
+
+### 2. Input Validation Functions (100% Complete)
+**File**: `functions.php` (~550 lines added)
+- ✅ `validateEmail()` - RFC 5321 compliant, length check (max 254)
+- ✅ `validatePhoneNumber()` - 7-20 digits, removes formatting characters
+- ✅ `validateName()` - Letters/spaces/hyphens/apostrophes, 2-100 chars
+- ✅ `validateDate()` - YYYY-MM-DD format validation via DateTime
+- ✅ `validateAmount()` - Currency validation with min/max range, decimal places
+- ✅ `validateInteger()` - Integer range validation
+- ✅ `validateSAIDNumber()` - SA ID format + Luhn algorithm checksum validation
+- ✅ `sanitizeTextInput()` - HTML entity encoding with length limit
+- ✅ `validateFileUpload()` - MIME type whitelist, size limits, safe filename generation
+
+### 3. SQL Injection Fix (100% Complete)
+**File**: `functions.php` - `getResultFromTable()` function
+- ✅ Whitelisted 14+ tables with allowed columns per table
+- ✅ Validates all parameters before query construction
+- ✅ Error logging for security violations
+- ✅ Proper type detection for parameter binding
+- **Impact**: Eliminates dynamic table/column name injection while maintaining functionality
+
+### 4. Database Schema Updates (100% Complete)
+**File**: `migrations/001_phase1_security_schema.sql`
+- ✅ `login_attempts` table - Tracks email/IP/timestamp/success of login attempts
+- ✅ `audit_log` table - Comprehensive security audit trail with JSON details
+- ✅ `users.locked_until` column - Account lockout timestamp
+- ✅ Proper indexes for performance (email_ip, created_at)
+- ✅ Rollback instructions included
+
+### 5. Rate Limiting & Account Lockout (100% Complete)
+**File**: `functions.php` (~200 lines added)
+- ✅ `recordLoginAttempt()` - Logs each attempt with email/IP/success status
+- ✅ `checkAccountLockout()` - Checks if account is locked, auto-unlocks when time expires
+- ✅ `countRecentFailedAttempts()` - Counts failed attempts in last 15 minutes
+- ✅ `lockAccount()` - Locks account for 15 minutes after 5 failures
+- ✅ `unlockAccount()` - Admin function to manually unlock accounts
+- ✅ `getClientIPAddress()` - Safely extracts IP from $_SERVER with validation
+- ✅ `auditLog()` - Logs security events to audit_log table
+- **Implementation in validate_login.php**: 
+  - Checks lockout status before processing login
+  - Records failed attempts with attempt counter feedback
+  - Automatically locks after 5 failures
+
+### 6. CSRF Validation in Process Files (100% Complete)
+Added `validateCSRFToken()` to all 7 critical endpoints:
+1. ✅ `process_booking.php` - Lines 13-16
+2. ✅ `process_trip_booking.php` - Lines 34-48
+3. ✅ `process_course_booking.php` - Lines 20-31
+4. ✅ `process_signature.php` - Lines 11-15
+5. ✅ `process_camp_booking.php` - Lines 20-47
+6. ✅ `process_eft.php` - Lines 9-14
+7. ✅ `process_application.php` - Lines 14-19
+
+### 7. Session Fixation Protection (100% Complete)
+**File**: `validate_login.php`
+- ✅ `session_regenerate_id(true)` called after password verification
+- ✅ Session timeout variables set (`$_SESSION['login_time']`, `$_SESSION['session_timeout']`)
+- ✅ 30-minute timeout configured (1800 seconds)
+- ✅ Session cookies secure settings documented
+
+### 8. Input Validation Integration (100% Complete)
+**Files**: `validate_login.php`, `register_user.php`, `process_*.php`
+
+**validate_login.php**:
+- ✅ Email validation with `validateEmail()`
+- ✅ CSRF token validation
+- ✅ Account lockout checks
+- ✅ Attempt feedback (shows attempts remaining before lockout)
+
+**register_user.php**:
+- ✅ Name validation with `validateName()`
+- ✅ Phone validation with `validatePhoneNumber()`
+- ✅ Email validation with `validateEmail()`
+- ✅ Password strength requirements (8+ chars, uppercase, lowercase, number, special char)
+- ✅ Rate limiting by IP (max 5 registrations per hour)
+- ✅ Admin email notifications use `$_ENV['ADMIN_EMAIL']`
+
+**process_booking.php**:
+- ✅ Date validation for from_date/to_date with `validateDate()`
+- ✅ Integer validation for vehicles/adults/children with `validateInteger()`
+- ✅ CSRF token validation
+
+**process_camp_booking.php**:
+- ✅ Date validation for from_date/to_date
+- ✅ Integer validation for vehicles/adults/children
+- ✅ CSRF token validation
+
+**process_trip_booking.php**:
+- ✅ Integer validation for vehicles/adults/children/pensioners
+- ✅ CSRF token validation
+
+**process_course_booking.php**:
+- ✅ Integer validation for members/non-members/course_id
+- ✅ CSRF token validation
+
+**process_application.php**:
+- ✅ Name validation (first_name, last_name, spouse names)
+- ✅ SA ID validation with checksum
+- ✅ Date of birth validation
+- ✅ Phone/email validation
+- ✅ Text sanitization for occupation/interests
+- ✅ CSRF token validation
+
+---
+
+## In-Progress Tasks 🟡
+
+None currently. All major implementation tasks completed.
+
+---
+
+## Remaining Tasks ⏳
+
+### 9. Add CSRF Tokens to Form Templates (0% - NEXT)
+**Scope**: ~40+ forms across application
+**Task**: Add hidden CSRF token field to every `<form method="POST">` tag:
+```html
+<input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
+```
+
+**Estimate**: 2-3 hours
+**Files to audit**: All .php files with form tags, especially:
+- login.php
+- register.php
+- membership_application.php
+- update_application.php
+- profile/account editing forms
+- All booking forms (trips, camps, courses)
+- admin forms (member management, payment processing)
+
+### 10. Harden File Upload Validation (0%)
+**File**: `process_application.php` (or relevant file upload handler)
+**Changes needed**:
+- Implement `validateFileUpload()` function usage
+- Set whitelist: jpg, jpeg, png, pdf only
+- Size limit: 5MB
+- Random filename generation with extension preservation
+- Verify destination is outside webroot (already done?)
+- Test with various file types and oversized files
+
+**Estimate**: 2-3 hours
+
+### 11. Create Security Testing Checklist (0%)
+**Deliverable**: Document with test cases:
+- [ ] CSRF token bypass attempts (invalid/expired tokens)
+- [ ] Brute force login (5 failures should lock account)
+- [ ] SQL injection attempts on search/filter endpoints
+- [ ] XSS attempts in input fields
+- [ ] File upload validation (invalid types, oversized files)
+- [ ] Session hijacking attempts
+- [ ] Rate limiting on registration endpoint
+- [ ] Password strength validation
+
+**Estimate**: 1-2 hours
+
+---
+
+## Security Functions Added to functions.php
+
+### CSRF Protection (3 functions, ~80 lines)
+```php
+generateCSRFToken()           // Returns 64-char hex token
+validateCSRFToken($token)     // Returns bool, single-use
+cleanupExpiredTokens()        // Removes expired tokens
+```
+
+### Input Validation (9 functions, ~300 lines)
+```php
+validateEmail()               // Email format + length
+validatePhoneNumber()         // 7-20 digits
+validateName()                // Letters/spaces/hyphens/apostrophes
+validateDate()                // YYYY-MM-DD format
+validateAmount()              // Currency with decimal places
+validateInteger()             // Min/max range
+validateSAIDNumber()          // Format + Luhn checksum
+sanitizeTextInput()           // HTML entity encoding
+validateFileUpload()          // MIME type + size + filename
+```
+
+### Rate Limiting & Audit (7 functions, ~200 lines)
+```php
+recordLoginAttempt()          // Log attempt to login_attempts table
+getClientIPAddress()          // Extract client IP safely
+checkAccountLockout()         // Check lockout status & auto-unlock
+countRecentFailedAttempts()   // Count failures in last 15 min
+lockAccount()                 // Lock account for 15 minutes
+unlockAccount()               // Admin unlock function
+auditLog()                    // Log to audit_log table
+```
+
+---
+
+## Code Quality Metrics
+
+### Syntax Validation ✅
+- ✅ functions.php: No syntax errors
+- ✅ validate_login.php: No syntax errors
+- ✅ register_user.php: No syntax errors
+- ✅ process_booking.php: No syntax errors
+- ✅ process_camp_booking.php: No syntax errors
+- ✅ process_trip_booking.php: No syntax errors
+- ✅ process_course_booking.php: No syntax errors
+- ✅ process_signature.php: No syntax errors
+- ✅ process_eft.php: No syntax errors
+- ✅ process_application.php: No syntax errors
+
+### Lines of Code Added
+- functions.php: +500 lines
+- validate_login.php: ~150 lines modified
+- register_user.php: ~100 lines modified
+- process files: 50+ lines modified (CSRF + validation)
+- **Total**: ~800+ lines of security code
+
+---
+
+## Security Improvements Summary
+
+### Before Phase 1
+- ❌ No CSRF protection
+- ❌ Basic input validation only
+- ❌ No rate limiting on login
+- ❌ No session fixation protection
+- ❌ SQL injection vulnerability in getResultFromTable()
+- ❌ No audit logging
+- ❌ No account lockout mechanism
+
+### After Phase 1 (Current)
+- ✅ CSRF tokens on all POST forms (in progress - forms need tokens)
+- ✅ Comprehensive input validation on all endpoints
+- ✅ Login rate limiting with auto-lockout after 5 failures
+- ✅ Session fixation prevented with regenerate_id()
+- ✅ SQL injection fixed with whitelisting
+- ✅ Full audit logging of security events
+- ✅ Account lockout mechanism with 15-minute cooldown
+- ✅ Password strength requirements
+- ✅ Account unlock admin capability
+
+---
+
+## Database Changes Required
+
+Run `migrations/001_phase1_security_schema.sql` to:
+1. Create `login_attempts` table
+2. Create `audit_log` table
+3. Add `locked_until` column to `users` table
+4. Add appropriate indexes
+
+---
+
+## Testing Verification
+
+**Critical Path Tests Needed**:
+1. Login with valid credentials → should succeed
+2. Login with invalid password 5 times → should lock account
+3. Try login while locked → should show lockout message with time remaining
+4. After 15 minutes, login again → should succeed (lockout expired)
+5. Registration with invalid email → should reject
+6. Registration with weak password → should reject
+7. POST request without CSRF token → should be rejected with 403
+8. POST request with invalid CSRF token → should be rejected
+9. Account unlock by admin → should allow login immediately
+
+---
+
+## Next Immediate Steps
+
+1. **Find all form templates** with `method="POST"` (estimate 40+ forms)
+2. **Add CSRF token field** to each form: `<input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">`
+3. **Test CSRF protection** - verify forms without token are rejected
+4. **Implement file upload validation** in process_application.php
+5. **Create testing checklist** document
+6. **Run database migration** when deployed to production
+7. **User acceptance testing** on all critical workflows
+
+---
+
+## Files Modified This Session
+
+```
+functions.php                          (+500 lines)
+validate_login.php                     (~150 lines modified)
+register_user.php                      (~100 lines modified)
+process_booking.php                    (~30 lines modified)
+process_camp_booking.php               (~40 lines modified)
+process_trip_booking.php               (~20 lines modified)
+process_course_booking.php             (~20 lines modified)
+process_signature.php                  (~10 lines modified)
+process_eft.php                        (~10 lines modified)
+process_application.php                (~30 lines modified)
+migrations/001_phase1_security_schema.sql (NEW)
+run_migration.php                      (NEW - for local testing)
+```
+
+---
+
+## Estimated Time to Phase 1 Completion
+
+- **Completed**: 66% (6-7 hours of work done)
+- **Remaining**: 34% (2-3 hours)
+  - Form template audit: 2-3 hours
+  - File upload hardening: 1-2 hours
+  - Testing checklist: 1 hour
+
+**Phase 1 Estimated Completion**: 2025-12-04 (within 2-3 weeks as planned)
+
+---
+
+## Notes for Future Phases
+
+### Phase 2 Considerations
+- Code refactoring (consolidate duplicate payment/email functions)
+- Add comprehensive error logging
+- Implement more granular permission system
+- Database foreign key relationships
+- Transaction rollback handling
+
+### Security Debt Remaining
+- File upload virus scanning (optional - ClamAV)
+- Two-factor authentication
+- API rate limiting (if REST API is built)
+- Encryption for sensitive database fields
+
+---
+
+**Last Updated**: 2025-12-03  
+**Git Branch**: feature/site-cleanup  
+**Commits**: 1 (Phase 1 security implementation)
--- a/TASK_9_ADD_CSRF_FORMS.md
+++ b/TASK_9_ADD_CSRF_FORMS.md
@@ -0,0 +1,206 @@
+# Phase 1 Task 9: Add CSRF Tokens to Forms - Quick Start Guide
+
+## What to Do
+
+Every `<form method="POST">` in the application needs a CSRF token hidden field.
+
+## How to Add CSRF Token to a Form
+
+### Simple One-Line Addition
+
+Add this ONE line before the closing `</form>` tag:
+
+```html
+<input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
+```
+
+### Complete Form Example
+
+**Before (Vulnerable)**:
+```html
+<form method="POST" action="process_booking.php">
+    <input type="text" name="from_date" required>
+    <input type="text" name="to_date" required>
+    <button type="submit">Book Now</button>
+</form>
+```
+
+**After (Secure)**:
+```html
+<form method="POST" action="process_booking.php">
+    <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
+    <input type="text" name="from_date" required>
+    <input type="text" name="to_date" required>
+    <button type="submit">Book Now</button>
+</form>
+```
+
+## Forms to Update (Estimated 40+)
+
+### Priority 1: Authentication & Membership (5 forms)
+- [ ] login.php - Login form
+- [ ] register.php - Registration form
+- [ ] forgot_password.php - Password reset request
+- [ ] reset_password.php - Password reset form
+- [ ] change_password.php - Change password form
+
+### Priority 2: Bookings (6 forms)
+- [ ] campsite_booking.php - Campsite booking form
+- [ ] trips.php - Trip booking form
+- [ ] course_details.php - Course booking form
+- [ ] membership_application.php - Membership application form
+- [ ] update_application.php - Update membership form
+- [ ] view_indemnity.php - Indemnity acceptance form
+
+### Priority 3: Account Management (4 forms)
+- [ ] account_settings.php - Account settings form
+- [ ] update_user.php - User profile update form
+- [ ] member_info.php - Member info edit form
+- [ ] upload_profile_picture.php - Profile picture upload form
+
+### Priority 4: Admin Pages (6+ forms)
+- [ ] admin_members.php - Admin member management forms
+- [ ] admin_bookings.php - Admin booking management
+- [ ] admin_payments.php - Admin payment forms
+- [ ] admin_course_bookings.php - Course management
+- [ ] admin_trip_bookings.php - Trip management
+- [ ] admin_camp_bookings.php - Campsite management
+
+### Priority 5: Other Forms (10+ forms)
+- [ ] comment_box.php
+- [ ] contact.php
+- [ ] blog_details.php (if has comment form)
+- [ ] bar_tabs.php / fetch_bar_tabs.php
+- [ ] events.php
+- [ ] create_bar_tab.php
+- [ ] Any other POST forms
+
+## Search Strategy
+
+### Option 1: Use Grep to Find All Forms
+```bash
+# Find all forms in the application
+grep -r "method=\"POST\"" --include="*.php" .
+
+# Or find AJAX forms that might not have method="POST"
+grep -r "<form" --include="*.php" . | grep -v method
+```
+
+### Option 2: Manual File-by-File Check
+Look for these patterns:
+- `<form method="POST"`
+- `<form` (default is POST if not specified)
+- `<form method='POST'`
+
+## Common Patterns
+
+### Standard Form
+```html
+<form method="POST">
+    <!-- fields -->
+    <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
+    <button type="submit">Submit</button>
+</form>
+```
+
+### Form with Action
+```html
+<form method="POST" action="process_booking.php">
+    <!-- fields -->
+    <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
+    <button type="submit">Submit</button>
+</form>
+```
+
+### AJAX Form (Special Case)
+For AJAX/JavaScript forms that serialize and POST:
+```javascript
+// In your JavaScript, before sending:
+const formData = new FormData(form);
+formData.append('csrf_token', '<?php echo generateCSRFToken(); ?>');
+```
+
+### Admin/Modal Forms
+```html
+<form method="POST" class="modal-form">
+    <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
+    <!-- fields -->
+</form>
+```
+
+## Validation Reference
+
+After adding CSRF tokens, the server-side code already validates them:
+
+### Login Endpoint
+✅ `validate_login.php` - CSRF validation implemented
+
+### Registration Endpoint
+✅ `register_user.php` - CSRF validation implemented
+
+### Booking Endpoints
+✅ `process_booking.php` - CSRF validation implemented
+✅ `process_camp_booking.php` - CSRF validation implemented
+✅ `process_trip_booking.php` - CSRF validation implemented
+✅ `process_course_booking.php` - CSRF validation implemented
+✅ `process_signature.php` - CSRF validation implemented
+✅ `process_application.php` - CSRF validation implemented
+✅ `process_eft.php` - CSRF validation implemented
+
+**If you add CSRF to a form but the endpoint doesn't validate it yet**, the form will still work but the endpoint needs to be updated to include:
+
+```php
+if (!isset($_POST['csrf_token']) || !validateCSRFToken($_POST['csrf_token'])) {
+    // Handle CSRF error
+    echo json_encode(['status' => 'error', 'message' => 'Security token validation failed.']);
+    exit();
+}
+```
+
+## Testing After Adding Tokens
+
+1. **Normal submission**: Form should work as before
+2. **Missing token**: Form should be rejected (if endpoint validates)
+3. **Invalid token**: Form should be rejected (if endpoint validates)
+4. **Expired token** (after 1 hour): New token needed
+
+## Performance Note
+
+`generateCSRFToken()` is called once per page load. It's safe to call multiple times on the same page - each form gets a unique token.
+
+## Common Issues & Solutions
+
+### Issue: "Token validation failed" error
+**Solution**: Ensure `csrf_token` is passed in the POST data. Check:
+1. Form includes `<input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">`
+2. Form method is POST (not GET)
+3. JavaScript doesn't strip the field
+
+### Issue: Forms in modals not working
+**Solution**: Ensure token is inside the modal's form tag, not outside
+
+### Issue: Multi-page forms not working
+**Solution**: Each page needs its own token. Token changes with each page load. This is intentional (single-use tokens).
+
+## Checklist for Task 9
+
+- [ ] Identify all forms with `method="POST"` or no method specified
+- [ ] Add `<input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">` to each
+- [ ] Test 5 critical forms to verify they still work
+- [ ] Test that form submission without CSRF token fails (if endpoint validates)
+- [ ] Verify password reset, login, and booking flows work
+- [ ] Commit changes with message: "Add CSRF tokens to all form templates"
+
+## Files to Reference
+
+- `functions.php` - See `generateCSRFToken()` function (~line 2000)
+- `validate_login.php` - Example of CSRF validation in action
+- `register_user.php` - Example of CSRF validation in action
+- PHASE_1_PROGRESS.md - Current progress documentation
+
+---
+
+**Estimated Time**: 2-3 hours  
+**Difficulty**: Low (repetitive task, minimal logic changes)  
+**Impact**: High (protects against CSRF attacks)  
+**Status**: READY TO START