Security.php

Go to the documentation of this file.

<?php
/*
 * You may not change or alter any portion of this comment or credits
 * of supporting developers from this source code or any supporting source code
 * which is considered copyrighted (c) material of the original comment or credit authors.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

namespace Xoops\Core;

class Security
{
    private $errors = array();

    public function check($clearIfValid = true, $token = false, $name = 'XOOPS_TOKEN')
    {
        return $this->validateToken($token, $clearIfValid, $name);
    }

    public function createToken($timeout = 300, $name = 'XOOPS_TOKEN')
    {
        $this->garbageCollection($name);
        $timeout = ($timeout <= 0) ? 300 : $timeout;
        $token_id = Random::generateOneTimeToken();
        // save token data on the server
        if (!isset($_SESSION[$name . '_SESSION'])) {
            $_SESSION[$name . '_SESSION'] = array();
        }
        $token_data = array(
            'id' => $token_id, 'expire' => time() + intval($timeout)
        );
        array_push($_SESSION[$name . '_SESSION'], $token_data);
        return $token_id;
    }

    public function validateToken($token = false, $clearIfValid = true, $name = 'XOOPS_TOKEN')
    {
        $ret = false;
        $log = array();
        $token = ($token !== false)
            ? $token
            : (isset($_REQUEST[$name . '_REQUEST']) ? $_REQUEST[$name . '_REQUEST'] : '');
        if (empty($token) || empty($_SESSION[$name . '_SESSION'])) {
            $str = 'No valid token found in request/session';
            $this->setErrors($str);
            $log[] = array('Token Validation', $str);
        } else {
            $token_data =& $_SESSION[$name . '_SESSION'];
            if (is_array($token_data)) {
                foreach (array_keys($token_data) as $i) {
                    if ($token === $token_data[$i]['id']) {
                        if ($this->filterToken($token_data[$i])) {
                            if ($clearIfValid) {
                                // token should be valid once, so clear it once validated
                                unset($token_data[$i]);
                            }
                            $log[] = array('Token Validation', 'Valid token found');
                            $ret = true;
                        } else {
                            $str = 'Valid token expired';
                            $this->setErrors($str);
                            $log[] = array('Token Validation', $str);
                        }
                    }
                }
            }
            if (!$ret) {
                $log[] = array('Token Validation', 'No valid token found');
            }
            $this->garbageCollection($name);
        }
        \Xoops::getInstance()->preload()->triggerEvent('core.security.validatetoken.end', array($log));
        return $ret;
    }

    public function clearTokens($name = 'XOOPS_TOKEN')
    {
        $_SESSION[$name . '_SESSION'] = array();
    }

    public function filterToken($token)
    {
        return (!empty($token['expire']) && $token['expire'] >= time());
    }

    public function garbageCollection($name = 'XOOPS_TOKEN')
    {
        $sessionName = $name . '_SESSION';
        if (!empty($_SESSION[$sessionName]) && is_array($_SESSION[$sessionName])) {
            $_SESSION[$sessionName] = array_filter($_SESSION[$sessionName], array($this, 'filterToken'));
        }
    }

    public function checkReferer($docheck = 1)
    {
        $ref = \Xoops::getInstance()->getEnv('HTTP_REFERER');
        if ($docheck == 0) {
            return true;
        }
        if ($ref == '') {
            return false;
        }
        if (strpos($ref, \XoopsBaseConfig::get('url')) !== 0) {
            return false;
        }
        return true;
    }

    public function checkBadips()
    {
        $xoops = \Xoops::getInstance();
        if ($xoops->getConfig('enable_badips') == 1
            && isset($_SERVER['REMOTE_ADDR'])
            && $_SERVER['REMOTE_ADDR'] != ''
        ) {
            foreach ($xoops->getConfig('bad_ips') as $bi) {
                if (!empty($bi) && preg_match('/' . $bi . '/', $_SERVER['REMOTE_ADDR'])) {
                    exit();
                }
            }
        }
    }

    public function getTokenHTML($name = 'XOOPS_TOKEN')
    {
        $token = new \Xoops\Form\Token($name);
        return $token->render();
    }

    public function setErrors($error)
    {
        $this->errors[] = trim($error);
    }

    public function getErrors($ashtml = false)
    {
        if (!$ashtml) {
            return $this->errors;
        } else {
            $ret = '';
            if (is_array($this->errors)) {
                $ret = implode('<br />', $this->errors) . '<br />';
            }
            return $ret;
        }
    }
}