UrlSigner.php

Go to the documentation of this file.

<?php
 
namespace Elgg\Security;
 
class UrlSigner {
 
    const KEY_MAC = '__elgg_mac';
    const KEY_EXPIRES = '__elgg_exp';
 
    public function sign($url, $expires = false) {
        $url = elgg_normalize_url($url);
        
        $parts = parse_url($url);
 
        if (isset($parts['query'])) {
            $query = elgg_parse_str($parts['query']);
        } else {
            $query = [];
        }
 
        if (isset($query[self::KEY_MAC])) {
            throw new \InvalidArgumentException('URL has already been signed');
        }
 
        if ($expires) {
            $query[self::KEY_EXPIRES] = strtotime($expires);
        }
 
        ksort($query);
 
        $parts['query'] = http_build_query($query);
 
        $url = elgg_http_build_url($parts, false);
 
        $token = elgg_build_hmac($url)->getToken();
 
        return elgg_http_add_url_query_elements($url, [
            self::KEY_MAC => $token,
        ]);
    }
 
    public function isValid($url) {
 
        $parts = parse_url($url);
 
        if (isset($parts['query'])) {
            $query = elgg_parse_str($parts['query']);
        } else {
            $query = [];
        }
        
        if (!isset($query[self::KEY_MAC])) {
            // No signature found
            return false;
        }
 
        $token = $query[self::KEY_MAC];
        unset($query[self::KEY_MAC]);
 
        if (isset($query[self::KEY_EXPIRES]) && $query[self::KEY_EXPIRES] < time()) {
            // Signature has expired
            return false;
        }
 
        ksort($query);
        
        $parts['query'] = http_build_query($query);
 
        $url = elgg_http_build_url($parts, false);
        
        return elgg_build_hmac($url)->matchesToken($token);
 
    }
}