Csrf.php

Go to the documentation of this file.

<?php

namespace Elgg\Security;

use Elgg\Config;
use Elgg\Exceptions\Http\CsrfException;
use Elgg\Request;
use Elgg\Traits\TimeUsing;

class Csrf {

    use TimeUsing;

    protected $config;

    protected $session;

    protected $crypto;

    protected $hmac;

    public function __construct(
        Config $config,
        \ElggSession $session,
        Crypto $crypto,
        HmacFactory $hmac
    ) {

        $this->config = $config;
        $this->session = $session;
        $this->crypto = $crypto;
        $this->hmac = $hmac;
    }

    public function validate(Request $request) {
        $token = $request->getParam('__elgg_token');
        $ts = $request->getParam('__elgg_ts');

        $session_id = $this->session->getID();

        if (($token) && ($ts) && ($session_id)) {
            if ($this->validateTokenOwnership($token, $ts)) {
                if ($this->validateTokenTimestamp($ts)) {
                    // We have already got this far, so unless anything
                    // else says something to the contrary we assume we're ok
                    $returnval = $request->elgg()->events->triggerResults('action_gatekeeper:permissions:check', 'all', [
                        'token' => $token,
                        'time' => $ts
                    ], true);

                    if ($returnval) {
                        return;
                    } else {
                        throw new CsrfException($request->elgg()->translator->translate('actiongatekeeper:pluginprevents'));
                    }
                } else {
                    // this is necessary because of #5133
                    if ($request->isXhr()) {
                        throw new CsrfException($request->elgg()->translator->translate(
                            'js:security:token_refresh_failed',
                            [$this->config->wwwroot]
                        ));
                    } else {
                        throw new CsrfException($request->elgg()->translator->translate('actiongatekeeper:timeerror'));
                    }
                }
            } else {
                // this is necessary because of #5133
                if ($request->isXhr()) {
                    throw new CsrfException($request->elgg()->translator->translate('js:security:token_refresh_failed', [$this->config->wwwroot]));
                } else {
                    throw new CsrfException($request->elgg()->translator->translate('actiongatekeeper:tokeninvalid'));
                }
            }
        } else {
            $error_msg = $request->elgg()->translator->translate('actiongatekeeper:missingfields');
            throw new CsrfException($error_msg);
        }
    }

    public function isValidToken($token, $ts) {
        return $this->validateTokenOwnership($token, $ts) && $this->validateTokenTimestamp($ts);
    }

    protected function validateTokenTimestamp($ts) {
        $timeout = $this->getActionTokenTimeout();
        $now = $this->getCurrentTime()->getTimestamp();

        return ($timeout == 0 || ($ts > $now - $timeout) && ($ts < $now + $timeout));
    }

    public function getActionTokenTimeout() {
        // default to 2 hours
        $timeout = 2;
        if ($this->config->hasValue('action_token_timeout')) {
            // timeout set in config
            $timeout = $this->config->action_token_timeout;
        }
        
        $hour = 60 * 60;

        return (int) ((float) $timeout * $hour);
    }

    public function validateTokenOwnership($token, $timestamp, $session_token = '') {
        $required_token = $this->generateActionToken($timestamp, $session_token);

        return $this->crypto->areEqual($token, $required_token);
    }

    public function generateActionToken($timestamp, $session_token = '') {
        if (!$session_token) {
            $session_token = $this->session->get('__elgg_session');
            if (!$session_token) {
                return false;
            }
        }

        return $this->hmac
            ->getHmac([(int) $timestamp, $session_token], 'md5')
            ->getToken();
    }
}