note 121229 deleted from book.session by peehaa
| From: | peehaa@php.net | Date: | Thu, 15 Jun 2017 13:39:52 +0000 |
| Subject: | note 121229 deleted from book.session by peehaa | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-209136@lists.php.net to get a copy of this message | ||
Note Submitter: farhad dot pd at gmail dot com
----
session.php
<?php
class Session
{
public static $seesionFlashName = '__FlashBack';
/**
* [__construct description]
*/
public function __construct() {
}
public static function start() {
session_start();
}
public static function id() {
return sha1(session_id());
}
public static function regenerateId() {
session_regenerate_id(true);
}
/**
* [exists description]
* @param [type] $name [description]
* @return [type] [description]
*/
public static function exists($name) {
if(isset($name) && $name != '') {
if(isset($_SESSION[$name])) {
return true;
}
}
return false;
}
/**
* [set description]
* @param [type] $name [description]
* @param [type] $value [description]
*/
public static function set($name='', $value='') {
if($name != '' && $value != '') {
$_SESSION[$name] = $value;
}
}
/**
* [get description]
* @param [type] $name [description]
* @return [type] [description]
*/
public static function get($name) {
if(self::exists($name)) {
return $_SESSION[$name];
}
return false;
}
/**
* [delete description]
* @param [type] $name [description]
* @return [type] [description]
*/
public static function delete($name) {
if(self::exists($name)) {
unset($_SESSION[$name]);
}
return false;
}
/**
* [setFlash description]
* @param string $value [description]
*/
public static function setFlash($value='') {
if($value != '') {
self::set(self::$seesionFlashName, $value);
}
}
/**
* [getFlash description]
* @return [type] [description]
*/
public static function getFlash() {
if(self::exists(self::$seesionFlashName)) {
ob_start();
echo self::get(self::$seesionFlashName);
$content = ob_get_contents();
ob_end_clean();
self::delete(self::$seesionFlashName);
return $content;
}
return false;
}
/**
* [flashExists description]
* @return [type] [description]
*/
public static function flashExists() {
return self::exists(self::$seesionFlashName);
}
/**
* [destroy description]
* @return void [description]
*/
public static function destroy() {
foreach($_SESSION as $sessionName) {
self::delete($sessionName);
}
session_destroy();
}
}
?>
csrf.php
<?php
include 'session.php';
Session::start();
class Csrf extends Session
{
/**
* [$CSRFName description]
* @var string
*/
private $CSRFName = '';
/**
* [$CSRFToken description]
* @var string
*/
private $CSRFToken = '';
/**
* [__construct description]
*/
public function __construct() {
self::__construct();
}
/**
* [__tokenizer description]
* @return [type] [description]
*/
public static function __tokenizer() {
return hash('sha512',
uniqid('csrf_').':'.time().':'.self::id());
}
/**
* [generate description]
* @param [type] $name [description]
* @return [type] [description]
*/
public static function generate($name) {
self::set($name, self::__tokenizer());
$form_guard = '
<input type="hidden" name="CSRFName"
value="'.$name.'">
<input type="hidden" name="CSRFToken"
value="'.self::get($name).'">
';
return $form_guard;
}
/**
* [verify description]
* @param [type] $name [description]
* @return [type] [description]
*/
public static function verify() {
if(count($_REQUEST) > 0)
{
if ( !isset($_REQUEST['CSRFName']) or !isset($_REQUEST['CSRFToken']) )
{
trigger_error("No CSRFName found, probable invalid request.",E_USER_ERROR);
}
$name =$_REQUEST['CSRFName'];
$token=$_REQUEST['CSRFToken'];
if(self::exists($name)) {
$retriveHashToken = self::get($name);
$compare = hash_equals($retriveHashToken, $token);
return $compare;
}
return false;
}
}
}
if(isset($_POST['submit']) && $_POST['submit'] == 'true')
{
if(Csrf::verify()) {
echo 'csrf verify';
} else {
echo 'csrf not verify';
}
}
?>
<form method="post" action="">
<?php echo Csrf::generate('register_form_csrf'); ?>
<input type="submit" name="submit" value="true">
</form>