mirror/processwire
1
0
Fork 0
mirror of https://github.com/processwire/processwire.git synced 2025-08-25 23:56:41 +02:00
Code Issues Releases Wiki Activity

Fix issue processwire/processwire-issues#634 where single-use tokens in SessionCSRF needed an automatic reset to be consistent with behavior described the phpdoc

Browse Source
This commit is contained in:
Ryan Cramer
2018-07-18 07:45:38 -04:00
parent b439a4488f
commit 22fe5794d0
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
wire/core/SessionCSRF.php
View File

@@ -149,13 +149,15 @@ class SessionCSRF extends Wire {
* #pw-group-validating * #pw-group-validating
* *
* @param int|string|null $id Optional unique ID for this token, but required if checking a single use token. * @param int|string|null $id Optional unique ID for this token, but required if checking a single use token.
* @param bool|null Reset after checking? Or omit (null) for auto (which resets if single-use token, and not otherwise).
* @return bool * @return bool
* *
*/ */
public function hasValidToken($id = '') { public function hasValidToken($id = '', $reset = null) {
$tokenName = $this->getTokenName($id); $tokenName = $this->getTokenName($id);
$tokenValue = $this->getTokenValue($id); $tokenValue = $this->getTokenValue($id);
$valid = false;
if(strlen($id)) { if(strlen($id)) {
$singles = $this->session->get($this, 'singles'); $singles = $this->session->get($this, 'singles');
@@ -163,14 +165,19 @@ class SessionCSRF extends Wire {
// remove single use token // remove single use token
unset($singles[$tokenName]); unset($singles[$tokenName]);
$this->session->set($this, 'singles', $singles); $this->session->set($this, 'singles', $singles);
if($reset !== false) $reset = true;
} }
} }
if($this->config->ajax && isset($_SERVER["HTTP_X_$tokenName"]) && $_SERVER["HTTP_X_$tokenName"] === $tokenValue) return true; if($this->config->ajax && isset($_SERVER["HTTP_X_$tokenName"]) && $_SERVER["HTTP_X_$tokenName"] === $tokenValue) {
if($this->input->post($tokenName) === $tokenValue) return true; $valid = true;
} else if($this->input->post($tokenName) === $tokenValue) {
$valid = true;
}
if($reset) $this->resetToken($id);
// if this point is reached, token was invalid return $valid;
return false;
} }
/** /**