mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-08-24 15:13:04 +02:00
Code Issues Releases Wiki Activity

EONE-62 (New Feature): Introducing user tokens (token logic could change in the future);

Browse Source 
init_session automated user token check (POST or GET);
new referal e_form method (hidden field with proper user token value);
Admin UI protects now all its forms;
This commit is contained in:
secretr
2010-05-19 15:28:52 +00:00
parent 1fefab53d3
commit 40391d9856
3 changed files with 47 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
e107_handlers/user_model.php
View File

@@ -183,6 +183,17 @@ class e_user_model extends e_front_model
return ($this->isAdmin() ? $this->get('user_perms') : false);
}
public function getToken()
{
if($this->isUser()) return '';
if(null === $this->get('user_token'))
{
$this->set('user_token', md5($this->get('user_password').$this->get('user_lastvisit').$this->get('user_pwchange').$this->get('user_class')));
}
return $this->get('user_token');
}
public function isCurrent()
{
return false;
@@ -294,10 +305,21 @@ class e_user_model extends e_front_model
return $editor->isAdmin();
}
/**
* Check passed value against current user token
* @param string $token md5 sum of e.g. posted token
* @return boolean
*/
final public function checkToken($token)
{
$utoken = $this->getToken();
return (null !== $utoken && $token === md5($utoken));
}
/**
* Bad but required (BC) method of retrieving all user data
* It's here to be used from get_user_data() core function.
* DON'T USE IT unless you have VERY good reason to do it.
* DON'T USE THEM BOTH unless you have VERY good reason to do it.
*
* @return array
*/