103 lines
3.3 KiB
PHP
103 lines
3.3 KiB
PHP
<?php
|
|
/**
|
|
* CodeIgniter
|
|
*
|
|
* An open source application development framework for PHP
|
|
*
|
|
* This content is released under the MIT License (MIT)
|
|
*
|
|
* Copyright (c) 2014 - 2015, British Columbia Institute of Technology
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
* THE SOFTWARE.
|
|
*
|
|
* @package CodeIgniter
|
|
* @author EllisLab Dev Team
|
|
* @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
|
|
* @copyright Copyright (c) 2014 - 2015, British Columbia Institute of Technology (http://bcit.ca/)
|
|
* @license http://opensource.org/licenses/MIT MIT License
|
|
* @link http://codeigniter.com
|
|
* @since Version 1.0.0
|
|
* @filesource
|
|
*/
|
|
defined('BASEPATH') OR exit('No direct script access allowed');
|
|
|
|
|
|
class MY_Security extends CI_Security
|
|
{
|
|
|
|
public function csrf_verify()
|
|
{
|
|
|
|
// If it's not a POST request we will set the CSRF cookie
|
|
if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST')
|
|
{
|
|
return $this->csrf_set_cookie();
|
|
}
|
|
|
|
// Check if URI has been whitelisted from CSRF checks
|
|
if ($exclude_uris = config_item('csrf_exclude_uris'))
|
|
{
|
|
$uri = load_class('URI', 'core');
|
|
|
|
// assumes /controller/method in your url. adjust as needed.
|
|
$parts = explode("/",$uri->uri_string());
|
|
|
|
if (count($parts) >= 2) {
|
|
$class=$parts[0];
|
|
$method=$parts[1];
|
|
|
|
foreach ($exclude_uris as $exclude_url_data) {
|
|
|
|
if (@$exclude_url_data['controller'] == $class
|
|
&& @$exclude_url_data['method'] == $method) {
|
|
return $this;
|
|
}
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
// Do the tokens exist in both the _POST and _COOKIE arrays?
|
|
if ( ! isset($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name])
|
|
OR $_POST[$this->_csrf_token_name] !== $_COOKIE[$this->_csrf_cookie_name]) // Do the tokens match?
|
|
{
|
|
$this->csrf_show_error();
|
|
}
|
|
|
|
// We kill this since we're done and we don't want to polute the _POST array
|
|
unset($_POST[$this->_csrf_token_name]);
|
|
|
|
// Regenerate on every submission?
|
|
if (config_item('csrf_regenerate'))
|
|
{
|
|
// Nothing should last forever
|
|
unset($_COOKIE[$this->_csrf_cookie_name]);
|
|
$this->_csrf_hash = NULL;
|
|
}
|
|
|
|
$this->_csrf_set_hash();
|
|
$this->csrf_set_cookie();
|
|
|
|
log_message('info', 'CSRF token verified');
|
|
return $this;
|
|
|
|
}
|
|
|
|
|
|
} |