PHP check_ticket函数代码示例

 public function before_filter(&$action, &$args)
 {
     parent::before_filter($action, $args);
     // Lock context to user id
     $this->owner = $GLOBALS['user'];
     $this->context_id = $this->owner->id;
     $this->full_access = true;
     if (Config::get()->PERSONALDOCUMENT_OPEN_ACCESS) {
         $username = Request::username('username', $GLOBALS['user']->username);
         $user = User::findByUsername($username);
         if ($user && $user->id !== $GLOBALS['user']->id) {
             $this->owner = $user;
             $this->context_id = $user->id;
             $this->full_access = Config::get()->PERSONALDOCUMENT_OPEN_ACCESS_ROOT_PRIVILEDGED && $GLOBALS['user']->perms === 'root';
             URLHelper::bindLinkParam('username', $username);
         }
     }
     $this->limit = $GLOBALS['user']->cfg->PERSONAL_FILES_ENTRIES_PER_PAGE ?: Config::get()->ENTRIES_PER_PAGE;
     $this->userConfig = DocUsergroupConfig::getUserConfig($GLOBALS['user']->id);
     if ($this->userConfig['area_close'] == 1) {
         $this->redirect('document/closed/index');
     }
     if (Request::isPost()) {
         CSRFProtection::verifySecurityToken();
     }
     if (($ticket = Request::get('studip-ticket')) && !check_ticket($ticket)) {
         $message = _('Bei der Verarbeitung Ihrer Anfrage ist ein Fehler aufgetreten.') . "\n" . _('Bitte versuchen Sie es erneut.');
         PageLayout::postMessage(MessageBox::error($message));
         $this->redirect('document/files/index');
     }
 }

/**
 * @param $mod_reference
 * @param $module_params
 */
function module_user_tasks_public($mod_reference, $module_params)
{
    global $user, $tiki_p_tasks, $prefs;
    $smarty = TikiLib::lib('smarty');
    $tikilib = TikiLib::lib('tiki');
    if ($user && isset($tiki_p_tasks) && $tiki_p_tasks == 'y') {
        global $tasklib;
        require_once 'lib/tasks/tasklib.php';
        $smarty->assign('ownurl', $_SERVER['REQUEST_URI']);
        $user_groups = $tasklib->get_groups_to_user_with_permissions($user, 'tiki_p_tasks_receive');
        if (isset($_REQUEST['modTasksSearch'])) {
            check_ticket('user-prefs');
            $user_group = $_REQUEST['user_group'];
            $tikilib->set_user_preference($user, 'tasks_modLastSelectedGroup', $user_group);
        } else {
            $user_group = $tikilib->get_user_preference($user, 'tasks_modLastSelectedGroup', '');
        }
        $smarty->assign('user_group', $user_group);
        if ($user_group == '') {
            $public_tasks = array('data' => '');
        } else {
            $public_tasks = $tasklib->list_tasks($user, '0', '10', NULL, 'priority_asc', false, false, false, false, true, $user_group);
        }
        $smarty->assign('public_tasks', $public_tasks['data']);
        $smarty->assign('user_groups', $user_groups);
        $smarty->clear_assign('tpl_module_title');
    }
}

 /**
  * Generic ticket check
  *
  * @throws AccessDeniedException if ticket is missing or invalid
  */
 protected function check_ticket()
 {
     $ticket = Request::get('studipticket');
     if (!$ticket || !check_ticket($ticket)) {
         throw new InvalidSecurityTokenException();
     }
 }

<?php

// (c) Copyright 2002-2013 by authors of the Tiki Wiki CMS Groupware Project
//
// All Rights Reserved. See copyright.txt for details and a complete list of authors.
// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details.
// $Id: include_security.php 51166 2014-05-07 16:00:38Z arildb $
//this script may only be included - so its better to die if called directly.
if (strpos($_SERVER["SCRIPT_NAME"], basename(__FILE__)) !== false) {
    header("location: index.php");
    exit;
}
if (isset($_REQUEST["security"])) {
    check_ticket('admin-inc-security');
}
if (!extension_loaded('mcrypt')) {
    global $smarty;
    $smarty->assign('no_mcrypt', 'y');
}
ask_ticket('admin-inc-security');

        $smarty->assign('footerRow', $info["footerRow"]);
        $smarty->assign('parseValues', $info["parseValues"]);
    } else {
        $smarty->assign('className', 'default');
        $smarty->assign('headerRow', '0');
        $smarty->assign('footerRow', '0');
        $smarty->assign('parseValues', 'n');
        $smarty->assign('creator', $user);
        $smarty->assign('parentSheetId', 0);
    }
}
$cat_type = 'sheet';
// Process the insertion or modification of a sheet here
if (isset($_REQUEST["edit"])) {
    $access->check_permission('tiki_p_edit_sheet');
    check_ticket('sheet');
    // Everything is ok so we proceed to edit the gallery
    $smarty->assign('edit_mode', 'y');
    $smarty->assign_by_ref('title', $_REQUEST["title"]);
    $smarty->assign_by_ref('description', $_REQUEST["description"]);
    $smarty->assign_by_ref('className', $_REQUEST["className"]);
    $smarty->assign_by_ref('headerRow', $_REQUEST["headerRow"]);
    $smarty->assign_by_ref('footerRow', $_REQUEST["footerRow"]);
    if (isset($_REQUEST['parseValues'])) {
        $_REQUEST['parseValues'] = 'y';
    } else {
        $_REQUEST['parseValues'] = 'n';
    }
    $smarty->assign_by_ref('parseValues', $_REQUEST['parseValues']);
    $gid = $sheetlib->replace_sheet($_REQUEST["sheetId"], $_REQUEST["title"], $_REQUEST["description"], isset($_REQUEST['creator']) ? $_REQUEST['creator'] : $user, $_REQUEST['parentSheetId'], $_REQUEST);
    $cat_objid = $gid;

    while (!feof($fp)) {
        $data .= fread($fp, 8192 * 16);
    }
    fclose($fp);
    if (strlen($data) > 1000000) {
        $smarty->assign('msg', tra("File is too big"));
        $smarty->display("error.tpl");
        die;
    }
    $size = $_FILES['userfile1']['size'];
    $name = $_FILES['userfile1']['name'];
    $type = $_FILES['userfile1']['type'];
    $notepadlib->replace_note($user, 0, $name, $data);
}
if (isset($_REQUEST["merge"])) {
    check_ticket('notepad-list');
    $merge = '';
    $first = true;
    if (!isset($_REQUEST["note"])) {
        $smarty->assign('msg', tra("No item indicated"));
        $smarty->display("error.tpl");
        die;
    }
    foreach (array_keys($_REQUEST["note"]) as $note) {
        $data_c = $notepadlib->get_note($user, $note);
        $data = $data_c['data'];
        if ($first) {
            $first = false;
            $merge .= "---------" . tra('merged note:') . $data_c['name'] . "----" . "\n";
            $merge .= $data;
        } else {

if (!isset($_REQUEST["assign_user"]) || $tiki_p_admin != 'y' && $tiki_p_admin_users != 'y') {
    $_REQUEST['assign_user'] = $user;
    $userChoice = 'y';
    $smarty->assign_by_ref('userChoice', $userChoice);
} else {
    if (!$userlib->user_exists($_REQUEST['assign_user'])) {
        $smarty->assign('msg', tra("User doesn't exist"));
        $smarty->display("error.tpl");
        die;
    }
    $userChoice = '';
    $smarty->assign_by_ref('assign_user', $_REQUEST['assign_user']);
}
$assign_user = $_REQUEST["assign_user"];
if (isset($_REQUEST["action"])) {
    check_ticket('admin-assign-user');
    if (!isset($_REQUEST["group"])) {
        $smarty->assign('msg', tra("You have to indicate a group"));
        $smarty->display("error.tpl");
        die;
    }
    if ($userChoice == 'y') {
        $gps = $userlib->get_groups(0, -1, 'groupName_asc', '', '', '', '', $userChoice);
        $groups = array();
        foreach ($gps['data'] as $g) {
            $groups[$g['groupName']] = $g;
        }
    } elseif ($tiki_p_admin != 'y') {
        $groups = $userlib->get_user_groups_inclusion($user);
    }
    if ($_REQUEST["action"] == 'assign') {

    }
}
if (isset($_REQUEST['imagegallistprefs'])) {
    check_ticket('admin-inc-gal');
    $pref_toggles = array('gal_list_name', 'gal_list_parent', 'gal_list_description', 'gal_list_created', 'gal_list_lastmodif', 'gal_list_user', 'gal_list_imgs', 'gal_list_visits');
    foreach ($pref_toggles as $toggle) {
        simple_set_toggle($toggle);
    }
}
if (isset($_REQUEST['imagegalcomprefs'])) {
    check_ticket('admin-inc-gal');
    simple_set_value('image_galleries_comments_per_page');
    simple_set_value('image_galleries_comments_default_order');
}
if (isset($_REQUEST['mvimg']) && isset($_REQUEST['move_gallery'])) {
    check_ticket('admin-inc-gal');
    if ($_REQUEST['mvimg'] == 'to_fs' && $prefs['gal_use_db'] == 'n' || $_REQUEST['mvimg'] == 'to_db' && $prefs['gal_use_db'] == 'y') {
        $mvresult = $imagegallib->move_gallery_store($_REQUEST['move_gallery'], $_REQUEST['mvimg']);
        $mvmsg = sprintf(tra('moved %d images, %d errors occurred.'), $mvresult['moved_images'], $mvresult['errors']);
        if ($mvresult['timeout']) {
            $mvmsg .= ' ' . tra('a timeout occurred. Hit the reload button to move the rest');
        }
        $tikifeedback[]['mes'] = $mvmsg;
    }
}
if (!isset($_REQUEST['maxRows'])) {
    $_REQUEST['maxRows'] = $prefs['maxRowsGalleries'];
}
if (!isset($_REQUEST['rowImages'])) {
    $_REQUEST['rowImages'] = $prefs['rowImagesGalleries'];
}

if (!isset($_REQUEST['referer']) && isset($_SERVER['HTTP_REFERER'])) {
    $_REQUEST['referer'] = $_SERVER['HTTP_REFERER'];
}
if (isset($_REQUEST['referer'])) {
    $smarty->assign('referer', $_REQUEST['referer']);
}
if (isset($_REQUEST['assign'])) {
    $objectName = isset($_REQUEST['objectName']) ? $_REQUEST['objectName'] : NULL;
    $objectHref = isset($_REQUEST['objectHref']) ? $_REQUEST['objectHref'] : NULL;
    $addedGroups = array();
    $deletedGroups = array();
    if (!isset($_REQUEST['checked'])) {
        $_REQUEST['checked'] = array();
    }
    $old_watches = $tikilib->get_groups_watching($_REQUEST['objectId'], $_REQUEST['watch_event'], $objectType);
    check_ticket('object_watches');
    foreach ($all_groups as $g) {
        if (in_array($g, $_REQUEST['checked']) && !in_array($g, $old_watches)) {
            $tikilib->add_group_watch($g, $_REQUEST['watch_event'], $_REQUEST['objectId'], $objectType, $objectName, $objectHref);
            $addedGroups[] = $g;
        } elseif (!in_array($g, $_REQUEST['checked']) && in_array($g, $old_watches)) {
            $tikilib->remove_group_watch($g, $_REQUEST['watch_event'], $_REQUEST['objectId'], $objectType);
            $deletedGroups[] = $g;
        }
        $smarty->assign_by_ref('addedGroups', $addedGroups);
        $smarty->assign_by_ref('deletedGroups', $deletedGroups);
        $group_watches = $_REQUEST['checked'];
    }
    if ($objectType == 'Category') {
        $addedGroupsDesc = array();
        $deletedGroupsDesc = array();

$smarty->assign('contentId', $_REQUEST["contentId"]);
$smarty->assign('pId', 0);
$info = $dcslib->get_content($_REQUEST["contentId"]);
$smarty->assign('description', $info["description"]);
if (isset($_REQUEST["remove"])) {
    $access->check_authenticity();
    $dcslib->remove_programmed_content($_REQUEST["remove"]);
}
$smarty->assign('data', '');
$smarty->assign('publishDate', $tikilib->now);
//Use 12- or 24-hour clock for $publishDate time selector based on admin and user preferences
$userprefslib = TikiLib::lib('userprefs');
$smarty->assign('use_24hr_clock', $userprefslib->get_user_clock_pref($user));
$smarty->assign('actual', '');
if (isset($_REQUEST["save"])) {
    check_ticket('edit-programmed-content');
    if ($_REQUEST['content_type'] == 'page') {
        $content = 'page:' . $_REQUEST['page_name'];
    } else {
        $content = $_REQUEST['data'];
    }
    if (!empty($_REQUEST['Time_Meridian'])) {
        $_REQUEST['Time_Hour'] = date('H', strtotime($_REQUEST['Time_Hour'] . ':00 ' . $_REQUEST['Time_Meridian']));
    }
    $publishDate = TikiLib::make_time($_REQUEST["Time_Hour"], $_REQUEST["Time_Minute"], 0, $_REQUEST["Date_Month"], $_REQUEST["Date_Day"], $_REQUEST["Date_Year"]);
    $id = $dcslib->replace_programmed_content($_REQUEST["pId"], $_REQUEST["contentId"], $publishDate, $content, $_REQUEST['content_type']);
    $smarty->assign('data', $_REQUEST["data"]);
    $smarty->assign('publishDate', $publishDate);
    $smarty->assign('pId', $id);
    $_REQUEST['edit'] = $id;
}

    $usermoduleslib->assign_user_module($_REQUEST["module"], $_REQUEST["position"], $_REQUEST["order"], $user);
}
if (isset($_REQUEST["up"])) {
    check_ticket('user-modules');
    $usermoduleslib->up_user_module($_REQUEST["up"], $user);
}
if (isset($_REQUEST["down"])) {
    check_ticket('user-modules');
    $usermoduleslib->down_user_module($_REQUEST["down"], $user);
}
if (isset($_REQUEST["left"])) {
    check_ticket('user-modules');
    $usermoduleslib->set_column_user_module($_REQUEST["left"], $user, 'l');
}
if (isset($_REQUEST["right"])) {
    check_ticket('user-modules');
    $usermoduleslib->set_column_user_module($_REQUEST["right"], $user, 'r');
}
$orders = array();
for ($i = 1; $i < 50; $i++) {
    $orders[] = $i;
}
$smarty->assign_by_ref('orders', $orders);
$assignables = $usermoduleslib->get_user_assignable_modules($user);
if (count($assignables) > 0) {
    $smarty->assign('canassign', 'y');
} else {
    $smarty->assign('canassign', 'n');
}
$modules = $usermoduleslib->get_user_assigned_modules($user);
$smarty->assign('modules_l', $usermoduleslib->get_user_assigned_modules_pos($user, 'l'));

if (isset($_REQUEST['mapg'])) {
    check_ticket('g-admin-roles');
    if ($_REQUEST['op'] == 'add') {
        $users = $userlib->get_group_users($_REQUEST['group']);
        foreach ($users as $a_user) {
            $roleManager->map_user_to_role($_REQUEST['pid'], $a_user, $_REQUEST['role']);
        }
    } else {
        $users = $userlib->get_group_users($_REQUEST['group']);
        foreach ($users as $a_user) {
            $roleManager->remove_mapping($a_user, $_REQUEST['role']);
        }
    }
}
if (isset($_REQUEST['save_map'])) {
    check_ticket('g-admin-roles');
    if (isset($_REQUEST['user']) && isset($_REQUEST['role'])) {
        foreach ($_REQUEST['user'] as $a_user) {
            foreach ($_REQUEST['role'] as $role) {
                $roleManager->map_user_to_role($_REQUEST['pid'], $a_user, $role);
            }
        }
    }
}
// list mappings
if (!isset($_REQUEST["sort_mode"])) {
    $sort_mode = 'name_asc';
} else {
    $sort_mode = $_REQUEST["sort_mode"];
}
if (!isset($_REQUEST["offset"])) {

        $smarty->assign('mail_site', $_SERVER['SERVER_NAME']);
        $subject = $smarty->fetch('mail/share_subject.tpl');
    }
}
$smarty->assign('subject', $subject);
if (isset($_REQUEST['send'])) {
    if (!empty($_REQUEST['comment'])) {
        $smarty->assign('comment', $_REQUEST['comment']);
    }
    if (!empty($_REQUEST['share_token_notification'])) {
        $smarty->assign('share_token_notification', $_REQUEST['share_token_notification']);
    }
    if (!empty($_REQUEST['how_much_time_access'])) {
        $smarty->assign('how_much_time_access', $_REQUEST['how_much_time_access']);
    }
    check_ticket('share');
    if (empty($user) && $prefs['feature_antibot'] == 'y' && !$captchalib->validate()) {
        $errors[] = $captchalib->getErrors();
    } else {
        if ($report == 'y') {
            $email = !empty($prefs['feature_site_report_email']) ? $prefs['feature_site_report_email'] : (!empty($prefs['sender_email']) ? $prefs['sender_email'] : '');
            if (empty($email)) {
                $errors[] = tra("The mail can't be sent. Contact the administrator");
            }
            $_REQUEST['addresses'] = $email;
            $_REQUEST['do_email'] = 1;
        }
        if (isset($_REQUEST['do_email']) and $_REQUEST['do_email'] == 1) {
            // send
            // Fix for multi adresses with autocomplete funtionnality
            if (substr($_REQUEST['addresses'], -2) == ', ') {

    $menulib->remove_menu($_REQUEST['remove']);
}
if (isset($_REQUEST['save'])) {
    $access->check_ticket();
    if (!isset($_REQUEST['icon'])) {
        $_REQUEST['icon'] = null;
    }
    $_REQUEST['use_items_icons'] = isset($_REQUEST['use_items_icons']) && $_REQUEST['use_items_icons'] == 'on' ? 'y' : 'n';
    $_REQUEST['parse'] = isset($_REQUEST['parse']) && $_REQUEST['parse'] == 'on' ? 'y' : 'n';
    $menulib->replace_menu($_REQUEST['menuId'], $_REQUEST['name'], $_REQUEST['description'], $_REQUEST['type'], $_REQUEST['icon'], $_REQUEST['use_items_icons'], $_REQUEST['parse']);
    $_REQUEST['menuId'] = 0;
    $smarty->assign('menuId', 0);
    $smarty->assign('info', array('name' => '', 'description' => '', 'type' => 'd', 'icon' => null, 'use_items_icons' => 'n', 'parse' => 'n'));
}
if (isset($_REQUEST['clone']) && $_REQUEST['menuId'] > 0) {
    check_ticket('admin-menus');
    $menulib->clone_menu($_REQUEST['menuId']);
}
if (isset($_REQUEST['reset'])) {
    $access->check_authenticity(tra('Are you sure you want to reset the Application Menu to the current system default?'));
    $menulib->reset_app_menu();
}
if (!isset($_REQUEST['sort_mode'])) {
    $sort_mode = 'name_desc';
} else {
    $sort_mode = $_REQUEST['sort_mode'];
}
$smarty->assign_by_ref('sort_mode', $sort_mode);
if (!isset($_REQUEST['offset'])) {
    $offset = 0;
} else {

    $questions = TextToQuestions($_REQUEST['input_data']);
    foreach ($questions as $question) {
        $question_text = $question->getQuestion();
        $id = $quizlib->replace_quiz_question(0, $question_text, 'o', $_REQUEST['quizId'], 0);
        $temp_max = $question->getChoiceCount();
        for ($i = 0; $i < $temp_max; $i++) {
            $a = $question->GetChoice($i);
            $b = $question->GetCorrect($i);
            $quizlib->replace_question_option(0, $a, $b, $id);
        }
    }
    $smarty->assign('question', '');
    $smarty->assign('questionId', 0);
}
if (isset($_REQUEST['useQuestion'])) {
    check_ticket('edit-quiz-question');
    $info = $quizlib->get_quiz_question($_REQUEST['usequestionid']);
    $qid = $quizlib->replace_quiz_question(0, $info['question'], $info['type'], $_REQUEST['quizId'], $_REQUEST['position']);
    $options = $quizlib->list_quiz_question_options($info['questionId'], 0, -1, 'points_desc', '');
    foreach ($options['data'] as $opt) {
        $quizlib->replace_question_option(0, $opt['optionText'], $opt['points'], $qid);
    }
}
if (!isset($_REQUEST['sort_mode'])) {
    $sort_mode = 'position_asc';
} else {
    $sort_mode = $_REQUEST['sort_mode'];
}
if (!isset($_REQUEST['offset'])) {
    $offset = 0;
} else {