diff options
| author | Henry Sudhof <kellanved@phpbb.com> | 2007-10-03 15:05:54 +0000 |
|---|---|---|
| committer | Henry Sudhof <kellanved@phpbb.com> | 2007-10-03 15:05:54 +0000 |
| commit | 4defd8a8306fa8daa25427a37fb6db00bff390c7 (patch) | |
| tree | 7914a43cdc9b2d2107e7baeb7061990664bdd841 /phpBB/includes/functions.php | |
| parent | 87e2e62c34da983258944db361d9a9b9785737e6 (diff) | |
| download | forums-4defd8a8306fa8daa25427a37fb6db00bff390c7.tar forums-4defd8a8306fa8daa25427a37fb6db00bff390c7.tar.gz forums-4defd8a8306fa8daa25427a37fb6db00bff390c7.tar.bz2 forums-4defd8a8306fa8daa25427a37fb6db00bff390c7.tar.xz forums-4defd8a8306fa8daa25427a37fb6db00bff390c7.zip | |
Ok, here comes a big one. Poor updater. Also requires testing.
#i91
#i92
#i93
#i94
#i95
#i96
git-svn-id: file:///svn/phpbb/trunk@8120 89ea8834-ac86-4346-8a33-228a782c2dd0
Diffstat (limited to 'phpBB/includes/functions.php')
| -rw-r--r-- | phpBB/includes/functions.php | 64 |
1 files changed, 64 insertions, 0 deletions
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index cf7149afbf..682c3e7a86 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -1964,6 +1964,70 @@ function meta_refresh($time, $url) ); } +//Form validation + +/** +* Add a secret token to the form (requires the S_FORM_TOKEN template variable) +* @param string $form_name The name of the form; has to match the name used in check_form_key, otherwise no restrictions apply +*/ +function add_form_key($form_name) +{ + global $template, $user; + $now = time(); + $token = sha1($now . $user->data['user_form_salt'] . $form_name); + + $s_fields = build_hidden_fields(array( + 'creation_time' => $now, + 'form_token' => $token, + )); + $template->assign_vars(array( + 'S_FORM_TOKEN' => $s_fields, + )); +} + +/** +* Check the form key. Required for all altering actions not secured by confirm_box +* @param string $form_name The name of the form; has to match the name used in add_form_key, otherwise no restrictions apply +* @param int $timespan The maximum acceptable age for a submitted form in seconds. Defaults to the config setting. +* @param string $return_page The address for the return link +* @param bool $trigger If true, the function will triger an error when encountering an invalid form +* @param int $minimum_time The minimum acceptable age for a submitted form in seconds +*/ +function check_form_key($form_name, $timespan = false, $return_page = '', $trigger = false, $miniumum_time = false) +{ + global $user, $config; + + if ($timespan === false) + { + $timespan = $config['form_token_lifetime']; + } + if ($miniumum_time === false) + { + $miniumum_time = $config['form_token_mintime']; + } + if (isset($_POST['creation_time']) && isset($_POST['form_token'])) + { + $creation_time = abs(request_var('creation_time', 0)); + $token = request_var('form_token', ''); + + $diff = (time() - $creation_time); + + if (($diff > $miniumum_time) && (($diff < $timespan) || $timespan == -1)) + { + $key = sha1($creation_time . $user->data['user_form_salt'] . $form_name); + if ($key === $token) + { + return true; + } + } + } + if ($trigger) + { + trigger_error($user->lang['FORM_INVALID'] . $return_page); + } + return false; +} + // Message/Login boxes /** |