TYPO3  7.6
Public Member Functions | Protected Member Functions | Protected Attributes | List of all members
AbstractFormProtection Class Reference
Inheritance diagram for AbstractFormProtection:
BackendFormProtection DisabledFormProtection FrontendFormProtection InstallToolFormProtection

Public Member Functions

 __destruct ()
 
 clean ()
 
 generateToken ($formName, $action= '', $formInstanceName= '')
 
 validateToken ($tokenId, $formName, $action= '', $formInstanceName= '')
 
 persistSessionToken ()
 

Protected Member Functions

 getSessionToken ()
 
 generateSessionToken ()
 
 createValidationErrorMessage ()
 
 retrieveSessionToken ()
 

Protected Attributes

 $validationFailedCallback
 
 $sessionToken
 

Detailed Description

This class provides protection against cross-site request forgery (XSRF/CSRF) for forms.

For documentation on how to use this class, please see the documentation of the corresponding subclasses

Definition at line 26 of file AbstractFormProtection.php.

Constructor & Destructor Documentation

__destruct ( )

Frees as much memory as possible.

Definition at line 54 of file AbstractFormProtection.php.

Member Function Documentation

clean ( )

Deletes the session token and persists the (empty) token.

This function is intended to be called when a user logs on or off.

Returns
void

Definition at line 66 of file AbstractFormProtection.php.

References AbstractFormProtection\persistSessionToken().

createValidationErrorMessage ( )
protected

Creates or displays an error message telling the user that the submitted form token is invalid.

Returns
void

Definition at line 134 of file AbstractFormProtection.php.

Referenced by AbstractFormProtection\validateToken().

generateSessionToken ( )
protected

Generates the random token which is used in the hash for the form tokens.

Returns
string

Definition at line 123 of file AbstractFormProtection.php.

References GeneralUtility\generateRandomBytes().

Referenced by InstallToolFormProtection\retrieveSessionToken(), FrontendFormProtection\retrieveSessionToken(), and BackendFormProtection\retrieveSessionToken().

generateToken (   $formName,
  $action = '',
  $formInstanceName = '' 
)

Generates a token for a form by hashing the given parameters with the secret session token.

Calling this function two times with the same parameters will create the same valid token during one user session.

Parameters
string$formName
string$action
string$formInstanceName
Returns
string the 32-character hex ID of the generated token
Exceptions
\InvalidArgumentException

Definition at line 85 of file AbstractFormProtection.php.

References AbstractFormProtection\getSessionToken(), and GeneralUtility\hmac().

getSessionToken ( )
protected
persistSessionToken ( )
abstract

Saves the session token so that it can be used by a later incarnation of this class.

private

Returns
void

Referenced by AbstractFormProtection\clean().

retrieveSessionToken ( )
abstractprotected

Retrieves the session token.

Returns
string

Referenced by AbstractFormProtection\getSessionToken().

validateToken (   $tokenId,
  $formName,
  $action = '',
  $formInstanceName = '' 
)

Checks whether the token $tokenId is valid in the form $formName with $formInstanceName.

Parameters
string$tokenId
string$formName
string$action
string$formInstanceName
Returns
bool

Definition at line 104 of file AbstractFormProtection.php.

References AbstractFormProtection\createValidationErrorMessage(), AbstractFormProtection\getSessionToken(), and GeneralUtility\hmac().

Member Data Documentation

$sessionToken
protected
$validationFailedCallback
protected