From 12d7f76179b72d0f990495a4cad3ffa7dcbb60c9 Mon Sep 17 00:00:00 2001
From: Vitor Araujo <vitorgamer58@outlook.com>
Date: Tue, 8 Jan 2019 17:00:04 -0200
Subject: [PATCH 1/4] autocomplete="off" and fix minor bugs

autocomplete="off" in forms
and fix bug on input 2FA
based in https://developer.mozilla.org/pt-BR/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
---
 view/home.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/view/home.php b/view/home.php
index 0e97c53..f31870e 100644
--- a/view/home.php
+++ b/view/home.php
@@ -7,16 +7,16 @@
                 }
                 ?>
                 <p><?php echo $lang['FORM_LOGIN']; ?></p>
-                <form action="index.php" method="POST" class="clearfix">
+                <form action="index.php" method="POST" autocomplete="off" class="clearfix">
                     <input type="hidden" name="action" value="login" />
                     <div class="col-md-2"><input type="text" class="form-control" name="username" placeholder="<?php echo $lang['FORM_USER']; ?>"></div>
                     <div class="col-md-2"><input type="password" class="form-control" name="password" placeholder="<?php echo $lang['FORM_PASS']; ?>"></div>
-<div class="col-md-2"><input type "text" class="form-control" name="auth" placeholder="<?php echo $lang['FORM_2FA']; ?>"></div>
+<div class="col-md-2"><input type="text" class="form-control" name="auth" placeholder="<?php echo $lang['FORM_2FA']; ?>"></div>
                     <div class="col-md-2"><button type="submit" class="btn btn-default"><?php echo $lang['FORM_LOGIN']; ?></button></div>
                 </form>
                 <br />
                 <p><?php echo $lang['FORM_CREATE']; ?></p>
-                <form action="index.php" method="POST" class="clearfix">
+                <form action="index.php" method="POST" autocomplete="off" class="clearfix">
                     <input type="hidden" name="action" value="register" />
                     <div class="col-md-2"><input type="text" class="form-control" name="username" placeholder="<?php echo $lang['FORM_USER']; ?>"></div>
                     <div class="col-md-2"><input type="password" class="form-control" name="password" placeholder="<?php echo $lang['FORM_PASS']; ?>"></div>

From eda85bfbcbe7bcbfa423a9eabd770693c8333e06 Mon Sep 17 00:00:00 2001
From: Vitor Araujo <vitorgamer58@outlook.com>
Date: Wed, 9 Jan 2019 15:45:53 -0200
Subject: [PATCH 2/4] improve security issues

refer to https://github.com/johnathanmartin/piWallet/issues/88#issuecomment-452513729
X-XSS-Protection header and X-Content-Type-Options header
---
 view/header.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/view/header.php b/view/header.php
index c33eabd..402a318 100644
--- a/view/header.php
+++ b/view/header.php
@@ -1,4 +1,7 @@
-<?php if (!defined("IN_WALLET")) { die("Auth Error!"); } ?>
+<?php if (!defined("IN_WALLET")) { die("Auth Error!"); } 
+header("X-XSS-Protection: 1; mode=block");
+header("X-Content-Type-Options: nosniff");
+?>
 <!DOCTYPE HTML>
 
 <html>

From 1e602cb8707d2452b112327f322e62ab52590370 Mon Sep 17 00:00:00 2001
From: Vitor Araujo <vitorgamer58@outlook.com>
Date: Wed, 9 Jan 2019 16:13:41 -0200
Subject: [PATCH 3/4] passwords and addresses with autocomplete="off"

---
 view/admin_info.php | 4 ++--
 view/wallet.php     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/view/admin_info.php b/view/admin_info.php
index 1db6ab6..e08329f 100644
--- a/view/admin_info.php
+++ b/view/admin_info.php
@@ -26,7 +26,7 @@
 </table>
 <br />
 <p>Set new password:</p>
-<form action="<?php echo '?a=info&i=' . $info['id']; ?>" method="POST" class="clearfix" id="pwdform">
+<form action="<?php echo '?a=info&i=' . $info['id']; ?>" method="POST" autocomplete="off" class="clearfix" id="pwdform">
     <input type="hidden" name="action" value="password" />
     <div class="col-md-4"><input type="password" class="form-control" name="password" placeholder="New password"></div>
     <div class="col-md-2"><button type="submit" class="btn btn-default">Change password</button></div>
@@ -34,7 +34,7 @@
 <p id="pwdmsg"></p>
 <br />
 <p>Withdraw funds:</p>
-<form action="<?php echo '?a=info&i=' . $info['id']; ?>" method="POST" class="clearfix" id="withdrawform">
+<form action="<?php echo '?a=info&i=' . $info['id']; ?>" method="POST" autocomplete="off" class="clearfix" id="withdrawform">
     <input type="hidden" name="action" value="withdraw" />
     <div class="col-md-4"><input type="text" class="form-control" name="address" placeholder="Address"></div>
     <div class="col-md-2"><input type="text" class="form-control" name="amount" placeholder="Amount"></div>
diff --git a/view/wallet.php b/view/wallet.php
index 3e068a0..3e10399 100644
--- a/view/wallet.php
+++ b/view/wallet.php
@@ -50,7 +50,7 @@
 
 <br />
 <p><strong><?php echo $lang['WALLET_PASSUPDATE']; ?></strong></p>
-<form action="index.php" method="POST" class="clearfix" id="pwdform">
+<form action="index.php" method="POST" autocomplete="off" class="clearfix" id="pwdform">
     <input type="hidden" name="action" value="password" />
     <input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
     <div class="col-md-2"><input type="password" class="form-control" name="oldpassword" placeholder="<?php echo $lang['WALLET_PASSUPDATEOLD']; ?>"></div>
@@ -65,7 +65,7 @@
 <p><strong><?php echo $lang['WALLET_SEND']; ?></strong></p>
 <button type="button" class="btn btn-default" id="donate">Donate to <?=$fullname?> wallet's owner!</button><br />
 <p id="donateinfo" style="display: none;">Type the amount you want to donate and click <strong>Withdraw</strong></p>
-<form action="index.php" method="POST" class="clearfix" id="withdrawform">
+<form action="index.php" method="POST" autocomplete="off" class="clearfix" id="withdrawform">
     <input type="hidden" name="action" value="withdraw" />
     <input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
     <div class="col-md-4"><input type="text" class="form-control" name="address" placeholder="<?php echo $lang['WALLET_ADDRESS']; ?>"></div>

From 41211213e8e80f5b645f8fb6dc984b43b3fa80b4 Mon Sep 17 00:00:00 2001
From: Vitor Araujo <vitorgamer58@outlook.com>
Date: Thu, 17 Jan 2019 12:22:40 -0200
Subject: [PATCH 4/4] improvements

- Fix qr code don't show
- Fix cookies without HTTP Only and Secure flag
- Fiz session cookies without HTTP Only and Secure flag

refer to: https://github.com/johnathanmartin/piWallet/issues/88#issuecomment-452513729
---
 common.php      | 6 +++++-
 view/header.php | 5 +----
 view/wallet.php | 4 ++--
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/common.php b/common.php
index 9fe3668..f986737 100644
--- a/common.php
+++ b/common.php
@@ -1,10 +1,14 @@
 <?php
 //ini_set('display_startup_errors',1);
 //ini_set('display_errors',1);
+ini_set('session.cookie_httponly', 1);
+ini_set('session.cookie_secure', 1);
 //error_reporting(-1);
 
 session_start();
 header('Cache-control: private'); // IE 6 FIX
+header("X-XSS-Protection: 1; mode=block");
+header("X-Content-Type-Options: nosniff");
 
 define("WITHDRAWALS_ENABLED", true); //Disable withdrawals during maintenance
 
@@ -31,7 +35,7 @@ function satoshitrim($satoshitrim) {
 // register the session and set the cookie
 $_SESSION['lang'] = $lang;
 
-setcookie('lang', $lang, time() + (3600 * 24 * 30));
+setcookie('lang', $lang, time() + (3600 * 24 * 30), NULL, NULL, TRUE, TRUE);
 }
 else if(isSet($_SESSION['lang']))
 {
diff --git a/view/header.php b/view/header.php
index 402a318..c33eabd 100644
--- a/view/header.php
+++ b/view/header.php
@@ -1,7 +1,4 @@
-<?php if (!defined("IN_WALLET")) { die("Auth Error!"); } 
-header("X-XSS-Protection: 1; mode=block");
-header("X-Content-Type-Options: nosniff");
-?>
+<?php if (!defined("IN_WALLET")) { die("Auth Error!"); } ?>
 <!DOCTYPE HTML>
 
 <html>
diff --git a/view/wallet.php b/view/wallet.php
index 3e10399..21ef4d4 100644
--- a/view/wallet.php
+++ b/view/wallet.php
@@ -93,8 +93,8 @@
 foreach ($addressList as $address)
 {
 echo "<tr><td>".$address."</t>";?>
-<td><a href="<?php echo $server_url;?>qrgen/?address=<?php echo $address;?>">
-  <img src="<?php echo $server_url;?>qrgen/?address=<?php echo $address;?>" alt="QR Code" style="width:42px;height:42px;border:0;"></td><tr>
+<td><a href="qrgen/?address=<?php echo $address;?>">
+  <img src="qrgen/?address=<?php echo $address;?>" alt="QR Code" style="width:42px;height:42px;border:0;"></td><tr>
 <?php
 }
 ?>
