Fix CSRF vulnerability in opt-out when setCookieInNewWindow=1 (#14400)

* Fix CSRF vulnerability in opt-out when setCookieInNewWindow=1

* Add nonce to URL for setCookieInNewWindow

1 files changed, 8 insertions, 4 deletions

diff --git a/plugins/CoreAdminHome/OptOutManager.php b/plugins/CoreAdminHome/OptOutManager.php
index 8ee6690d99..b47f8c2cdc 100644
--- a/plugins/CoreAdminHome/OptOutManager.php
+++ b/plugins/CoreAdminHome/OptOutManager.php
@@ -175,12 +175,13 @@ class OptOutManager
             $reloadUrl = Url::getCurrentQueryStringWithParametersModified(array(
                 'showConfirmOnly' => 1,
                 'setCookieInNewWindow' => 0,
+                'nonce' => Common::getRequestVar('nonce')
             ));
         } else {
             $reloadUrl = false;
 
-            $nonce = Common::getRequestVar('nonce', false);
-            if ($nonce !== false && Nonce::verifyNonce('Piwik_OptOut', $nonce)) {
+            $requestNonce = Common::getRequestVar('nonce', false);
+            if ($requestNonce !== false && Nonce::verifyNonce('Piwik_OptOut', $requestNonce)) {
                 Nonce::discardNonce('Piwik_OptOut');
                 IgnoreCookie::setIgnoreCookie();
                 $trackVisits = !$trackVisits;
@@ -192,11 +193,14 @@ class OptOutManager
             ? $language
             : LanguagesManager::getLanguageCodeForCurrentUser();
 
+        $nonce = Nonce::getNonce('Piwik_OptOut', 3600);
+
         $this->addQueryParameters(array(
             'module' => 'CoreAdminHome',
             'action' => 'optOut',
             'language' => $lang,
-            'setCookieInNewWindow' => 1
+            'setCookieInNewWindow' => 1,
+            'nonce' => $nonce
         ), false);
 
         $this->addStylesheet($this->optOutStyling());
@@ -208,7 +212,7 @@ class OptOutManager
         $this->view->setXFrameOptions('allow');
         $this->view->dntFound = $dntFound;
         $this->view->trackVisits = $trackVisits;
-        $this->view->nonce = Nonce::getNonce('Piwik_OptOut', 3600);
+        $this->view->nonce = $nonce;
         $this->view->language = $lang;
         $this->view->showConfirmOnly = Common::getRequestVar('showConfirmOnly', false, 'int');
         $this->view->reloadUrl = $reloadUrl;