Security helper class.
Class declared in SYSPATH/classes/Security.php on line 3.
string $token_namelink to thiskey name used for token storage
string(14) "security_token"Check that the given token matches the currently stored security token.
if(Security::check($token)){// Pass}
string
$token
required - Token to check boolean
publicstaticfunctioncheck($token){returnSecurity::slow_equals(Security::token(),$token);}
Encodes PHP tags in a string.
$str= Security::encode_php_tags($str);
string
$str
required - String to sanitize string
publicstaticfunctionencode_php_tags($str){returnstr_replace(['<?','?>'], ['<?','?>'],$str);}
Compare two hashes in a time-invariant manner. Prevents cryptographic side-channel attacks (timing attacks, specifically)
string
$a
required - Cryptographic hash string
$b
required - Cryptographic hash boolean
publicstaticfunctionslow_equals($a,$b){$diff=strlen($a) ^strlen($b);for($i= 0;$i<strlen($a) AND$i<strlen($b);$i++) {$diff|= ord($a[$i]) ^ ord($b[$i]);}return$diff=== 0;}
Generate and store a unique token which can be used to help prevent CSRF attacks.
$token= Security::token();
You can insert this token into your forms as a hidden field:
echoForm::hidden('csrf', Security::token());
And then check it when using Validation:
$array->rules('csrf', [['not_empty'],['Security::check'],]);
This provides a basic, but effective, method of preventing CSRF attacks.
boolean
$new
= bool FALSE - Force a new token to be generated? string
publicstaticfunctiontoken($new= false){$session= Session::instance();// Get the current token$token=$session->get(Security::$token_name);if($new=== true OR !$token) {// Generate a new unique tokenif(function_exists('openssl_random_pseudo_bytes')) {// Generate a random pseudo bytes token if openssl_random_pseudo_bytes is available// This is more secure than uniqid, because uniqid relies on microtime, which is predictable$token=base64_encode(openssl_random_pseudo_bytes(32));}else{// Otherwise, fall back to a hashed uniqid$token= sha1(uniqid(null, true));}// Store the new token$session->set(Security::$token_name,$token);}return$token;}