Changeset 29 for trunk/patSession

Timestamp:

11/11/04 12:40:30 (4 years ago)

Author:

gerd

Message:

Added support for Tokens

Files:

• trunk/patSession/Storage.php (modified) (7 diffs)

trunk/patSession/Storage.php

@@ -56 +56 @@
-        
-   /**
+        * accept tokens send by
+        * @access protected
+        * @var  string $_tokenmode
+        */
+        var     $_tokenmode     =       'cookie';
+        
+   /**
-        * security policy
-        * Default values:
@@ -65 +72 @@
-        * @var array $_security list of checks that will be done.
-        */
-, 'use_token'
+
-
-   /**
@@ -78 +85 @@
-        */
-        var     $_emptyReferer  =       null;
+        
+   /**
+        * psst stands for: patSession Security Token
+        * @var  string $_tokenName 
+        */
+        //var   $_tokenName     =       'psst';
+        var     $_tokenName     =       'patSessionSecurityToken';
+        
+   /**
+        * disposable controll value for each request
+        * @var  string $_
+        */
+        var     $_tokenValue    =       null;
-        
-   /**
@@ -102 +122 @@
-    function getQueryString()
-    {
-
+
+
+
+
+
+
+
-    }
-
@@ -281 +307 @@
-                        $this->set( '_patSession_clientForwarded', null );
-                        $this->set( '_patSession_clientBrowser', null );
+                        $this->set( '_patSession_token', null );
-                }
-                
@@ -387 +414 @@
-                }
-                
+                // check token!
+                if( in_array( 'use_token', $this->_security ) )
+                {
+                        $token  =       $this->get( '_patSession_token' );
+                        
+                        // check if token is valid! 
+                        if( $token !== null )
+                        {
+                                $match  =       false;
+                                
+                                // check token from cookie - this mode is prefered, because it supports browser navigation 
+                                // like "reload", "back" and "forward"
+                                if( ( $this->_tokenmode == 'any' || $this->_tokenmode == 'cookie' ) 
+                                        && isset( $_COOKIE[$this->_tokenName] ) && $_COOKIE[$this->_tokenName] == $token )
+                                {
+                                        $match  =       true;
+                                }
+                                
+                                // check token send as get parameter
+                                if( $this->_tokenmode == 'any' || $this->_tokenmode == 'get' ) 
+                                {
+                                        if( preg_match( '|[\?&]?'.$token.'&?|', $_SERVER['QUERY_STRING'] ) )
+                                        {
+                                                $match  =       true;
+                                        }
+                                }
+                        
+                                if( !$match )
+                                {
+                                        $this->_state   =       'token_dismatch';
+                                        return false;
+                                }
+                        }
+                        
+                        
+                        // save new token
+                        $token  =       $this->_createId( 12 );
+                        $this->set( '_patSession_token', $token );
+                        
+                        // use get parameter to store session token
+                        if( $this->_tokenmode == 'any' || $this->_tokenmode == 'get' )
+                        {
+                                $this->_tokenValue      =       $token;
+                        }
+
+                        // try to set a cookie                  
+                        if( $this->_tokenmode == 'any' || $this->_tokenmode == 'cookie' )
+                        {
+                                setcookie( $this->_tokenName, $token );
+                        }
+                }
+                
-                return true;
-        }
@@ -432 +511 @@
-                }
-                
+                // set token mode
+                if( isset( $options['tokenmode'] ) && in_array( $options['tokenmode'], array( 'any', 'cookie', 'get' ) ) )
+                {
+                        $this->_tokenmode       =       $options['tokenmode'];
+                }
+                
-                // some referers are allowed
-                if( isset( $options['allow-referer'] ) )