vendor/contao/core-bundle/src/Resources/contao/library/Contao/RequestToken.php line 15

Open in your IDE?
  1. <?php
  3. /*
  4. * This file is part of Contao.
  5. *
  6. * (c) Leo Feyer
  7. *
  8. * @license LGPL-3.0-or-later
  9. */
  11. namespace Contao;
  13. use Symfony\Component\Security\Csrf\CsrfToken;
  15. trigger_deprecation('contao/core-bundle', '4.0', 'Using the "Contao\RequestToken" class has been deprecated and will no longer work in Contao 5.0. Use the Symfony CSRF service via the container instead.');
  17. /**
  18. * Generates and validates request tokens
  19. *
  20. * The class tries to read and validate the request token from the user session
  21. * and creates a new token if there is none.
  22. *
  23. * Usage:
  24. *
  25. * echo RequestToken::get();
  26. *
  27. * if (!RequestToken::validate('TOKEN'))
  28. * {
  29. * throw new Exception("Invalid request token");
  30. * }
  31. *
  32. * @deprecated Deprecated since Contao 4.0, to be removed in Contao 5.0.
  33. * Use the Symfony CSRF service via the container instead.
  34. */
  35. class RequestToken
  36. {
  37. /**
  38. * Read the token from the session or generate a new one
  39. */
  40. public static function initialize()
  41. {
  42. // ignore
  43. }
  45. /**
  46. * Return the token
  47. *
  48. * @return string The request token
  49. */
  50. public static function get()
  51. {
  52. $container = System::getContainer();
  54. return $container->get('contao.csrf.token_manager')->getDefaultTokenValue();
  55. }
  57. /**
  58. * Validate a token
  59. *
  60. * @param string $strToken The request token
  61. *
  62. * @return boolean True if the token matches the stored one
  63. */
  64. public static function validate($strToken)
  65. {
  66. // The feature has been disabled
  67. if (\defined('BYPASS_TOKEN_CHECK') || Config::get('disableRefererCheck'))
  68. {
  69. return true;
  70. }
  72. // Check against the whitelist (thanks to Tristan Lins) (see #3164)
  73. if (Config::get('requestTokenWhitelist'))
  74. {
  75. $strHostname = gethostbyaddr($_SERVER['REMOTE_ADDR']);
  77. foreach (Config::get('requestTokenWhitelist') as $strDomain)
  78. {
  79. if ($strDomain == $strHostname || preg_match('/\.' . preg_quote($strDomain, '/') . '$/', $strHostname))
  80. {
  81. return true;
  82. }
  83. }
  84. }
  86. $container = System::getContainer();
  88. return $container->get('contao.csrf.token_manager')->isTokenValid(new CsrfToken($container->getParameter('contao.csrf_token_name'), $strToken));
  89. }
  90. }
  92. class_alias(RequestToken::class, 'RequestToken');