-
Notifications
You must be signed in to change notification settings - Fork 6
Expand file tree
/
Copy pathSecurity.php
More file actions
87 lines (76 loc) · 2.16 KB
/
Security.php
File metadata and controls
87 lines (76 loc) · 2.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
<?php
namespace Foolz\FoolFrame\Model;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
class Security extends Model
{
/**
* @var string
*/
protected $token;
/**
* @var Config
*/
protected $config;
/**
* @param Context $context
*/
public function __construct(Context $context)
{
$this->context = $context;
$this->config = $context->getService('config');
$this->token = uniqid('', true);
}
/**
* Returns the CSRF token for this Security object
*
* @return string
*/
public function getCsrfToken()
{
return $this->token;
}
public function getJsCsrfToken()
{
return '<script> var csrf_token = \''.addslashes($this->getCsrfToken()).'\'; </script>';
}
/**
* Sets a CSRF cookie
* @param Response $response
*/
public function updateCsrfToken(Response $response)
{
$response->headers->setCookie(new Cookie(
$this->getContext(),
'csrf_token',
$this->getCsrfToken(),
86400 * 5
));
}
/**
* Checks that the CSRF token cookie and POST match
*
* @param Request $request
* @return bool
*/
public function checkCsrfToken(Request $request)
{
$cookie_name = $this->config->get('foolz/foolframe', 'config', 'config.cookie_prefix').'csrf_token';
return $request->cookies->get($cookie_name) !== null
&& $request->request->get('csrf_token') !== null
&& $request->cookies->get($cookie_name) === $request->request->get('csrf_token');
}
/**
* Checks that the CSRF token cookie and POST match
*
* @param Request $request
* @return bool
*/
public function checkCsrfTokenGet(Request $request)
{
$cookie_name = $this->config->get('foolz/foolframe', 'config', 'config.cookie_prefix').'csrf_token';
return $request->cookies->get($cookie_name) !== null
&& $request->query->get('csrf_token') !== null
&& $request->cookies->get($cookie_name) === $request->query->get('csrf_token');
}
}