Cross-Site Request Forgery helper.
Class declared in MODPATH/gleez/classes/gleez/csrf.php on line 11.
integer $csrf_ttlToken time to live in seconds, 30 minutes
integer 1800
User specefic key used to generate unqiue tokens.
The user specefic private key.
static function key()
{
$token = Session::instance()->id();
$secret = self::_private_key();
return sha1($secret . $token);
}Get CSRF token
string
$id
= string(0) "" - Custom token id, e.g. uidstring
$action
= string(0) "" - Optional actioninteger
$time
= integer 0 - Used only internallystringpublic static function token($id = '', $action = '', $time = 0)
{
// Get id string for token, could be uid or ip etc
if (!$id) $id = Request::$client_ip;
// Get time to live
if (!$time) $time = ceil(time() / self::$csrf_ttl);
return sha1($time . self::key() . $id . $action);
}Validate CSRF token
string
$token
= bool FALSE - $tokenstring
$action
= string(0) "" - $id Custom token id, e.g. uidstring
$id
= string(0) "" - $action Optional actionbooleanpublic static function valid($token = false, $action = '', $id = '')
{
token and action from Form POST
if (!$token) $token = Arr::get($_REQUEST, '_token');
if (!$action) $action = Arr::get($_REQUEST, '_action');
// Get time to live
$time = ceil(time() / self::$csrf_ttl);
// Check token validity
return ($token === self::token($id, $action, $time) || $token === self::token($id, $action, $time - 1));
}Ensure the private key variable used to generate tokens is set.
The private key.
private static function _private_key()
{
g = Kohana::$config->load('site');
if ( !($key = $config->get('gleez_private_key')) )
{
$key = sha1(uniqid(mt_rand(), true)) . md5(uniqid(mt_rand(), true));
$config->set('gleez_private_key', $key);
}
return $key;
}