From e3de9d7dd1331f9718e04cc98e9ca7cfa27cf4aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20L=C3=A9cureuil?= <neoclust@mageia.org>
Date: Sun, 17 May 2020 14:46:00 +0200
Subject: Sync with master of moonmoon ( version 9.0.0-rc) Source from
 https://github.com/Emmafrs/moonmoon/

---
 common/app/classes/CSRF.php | 55 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 common/app/classes/CSRF.php

(limited to 'common/app/classes/CSRF.php')

diff --git a/common/app/classes/CSRF.php b/common/app/classes/CSRF.php
new file mode 100644
index 0000000..9a700cf
--- /dev/null
+++ b/common/app/classes/CSRF.php
@@ -0,0 +1,55 @@
+<?php
+
+class CSRF
+{
+    /** @var string */
+    const HMAC_ALGORITHM = 'sha1';
+
+    /** @var string */
+    const SESSION_KEY_NAME = '_csrf_key';
+
+    /**
+     * Ensure that a CSRF token is valid for a given action.
+     *
+     * @param  string $token
+     * @param  string $action
+     * @return bool
+     */
+    public static function verify($token = '', $action = null)
+    {
+        if (!is_string($token) || !is_string($action)) {
+            return false;
+        }
+
+        $known = self::generate($action);
+        return hash_equals($known, $token);
+    }
+
+    /**
+     * Generate a CSRF token for a given action.
+     *
+     * @param  string $action
+     * @throws InvalidArgumentException
+     * @return string
+     */
+    public static function generate($action = null)
+    {
+        if (!is_string($action)) {
+            throw new InvalidArgumentException('A valid action must be defined.');
+        }
+        return hash_hmac(self::HMAC_ALGORITHM, $action, self::getKey());
+    }
+
+    /**
+     * Get HMAC key.
+     *
+     * @return string
+     */
+    public static function getKey()
+    {
+        if (empty($_SESSION[self::SESSION_KEY_NAME])) {
+            $_SESSION[self::SESSION_KEY_NAME] = random_bytes(16);
+        }
+        return $_SESSION[self::SESSION_KEY_NAME];
+    }
+}
-- 
cgit v1.2.1