PHP form_token函数代码示例

function output_form_start($f, $show_id, $show_token, $errors, $method, $fileupload, $params, $style)
{
    $form_id_input = '';
    $form_id_input .= $show_id ? '<input type="hidden" name="form_id" value="' . $f . '"/>' : '';
    $form_id_input .= $show_token ? '<input type="hidden" name="_t" value="' . form_token() . '"/>' : '';
    include "tpl_form_start_{$style}.php";
}

 /**
  * 做一个login
  */
 public function login()
 {
     if (IS_AJAX && 'submit' == I('post.submit')) {
         //login 操作
         $username = I('post.username');
         $userpass = I('post.userpass');
         //表单令牌
         if (token_check() == false) {
             printJson(array('tk' => form_token()), 1, '请求超时,请重试');
         }
         $mod = Factory::getModel('bt_user');
         $where = sprintf("username='%s' AND deleted=0", $username);
         $row = $mod->field('id,userpass,salt')->where($where)->find();
         if (empty($row)) {
             printJson(array('tk' => form_token()), 1, '账号不存在');
         }
         if ($row['userpass'] != md5($userpass . $row['salt'])) {
             printJson(array('tk' => form_token()), 1, '账号或者密码不正确');
         }
         $row['username'] = $username;
         session_regenerate_id();
         $user_cls = load_class('UserModel');
         $user_cls->setSessionUser($row);
         printJson(1);
     }
     $turl = urldecode(I('get.url', url('DiskTop', 'index')));
     $this->assign('turl', $turl);
     $this->display();
 }

function form_validate()
{
    global $mybb;
    $t = form_token();
    if ($t != $_POST['_t']) {
        error_page('Sorry, the form you submitted was invalid. Please try again.');
    }
}

 /**
  * Hooks to article saving process and updates short URLs
  */
 public static function update()
 {
     global $prefs;
     if (empty($prefs['rah_bitly_login']) || empty($prefs['rah_bitly_apikey']) || empty($prefs['rah_bitly_field'])) {
         return;
     }
     static $old = array();
     static $updated = false;
     $id = !empty($GLOBALS['ID']) ? $GLOBALS['ID'] : ps('ID');
     if (!$id || ps('_txp_token') != form_token() || intval(ps('Status')) < 4) {
         $old = array('permlink' => NULL, 'status' => NULL);
         return;
     }
     include_once txpath . '/publish/taghandlers.php';
     /*
     	Get the old article permlink before anything is saved
     */
     if (!$old) {
         $old = array('permlink' => permlinkurl_id($id), 'status' => fetch('Status', 'textpattern', 'ID', $id));
         return;
     }
     /*
     	Clear the permlink cache
     */
     unset($GLOBALS['permlinks'][$id]);
     /*
     	Generate a new if permlink has changed or if article is published
     */
     if (callback_event('rah_bitly.update') !== '') {
         return;
     }
     if ($updated == false && ($permlink = permlinkurl_id($id)) && ($old['permlink'] != $permlink || !ps('custom_' . $prefs['rah_bitly_field']) || $old['status'] != ps('Status'))) {
         $uri = self::fetch($permlink);
         if ($uri) {
             $fields = getCustomFields();
             if (!isset($fields[$prefs['rah_bitly_field']])) {
                 return;
             }
             safe_update('textpattern', 'custom_' . intval($prefs['rah_bitly_field']) . "='" . doSlash($uri) . "'", "ID='" . doSlash($id) . "'");
             $_POST['custom_' . $prefs['rah_bitly_field']] = $uri;
         }
         $updated = true;
     }
     if (!empty($uri)) {
         echo script_js('$(\'input[name="custom_' . $prefs['rah_bitly_field'] . '"]\').val("' . escape_js($uri) . '");');
     }
 }

/**
 * Form Open
 *
 * Create the form open tag as well as any hidden inputs. Also implements CSRF.
 *
 * @param	string	The action attribute
 * @param	string	A string of extra attributes
 * @param	array	An array of hidden elements
 * @param	bool	If CSRF should be enabled
 * @return	string	The form element and any hidden inputs
 */
function form_open($action = '', $attributes = '', $hidden = array(), $csrf_enabled = TRUE)
{
    $_ci =& get_instance();
    $_ci->load->library('form_validation');
    if ($attributes == '') {
        $attributes = 'method="post"';
    }
    $action = strpos($action, '://') === FALSE ? $_ci->config->site_url($action) : $action;
    $form = '<form action="' . $action . '"';
    $form .= _attributes_to_string($attributes, TRUE);
    $form .= '>';
    if (is_array($hidden) && count($hidden) > 0) {
        $form .= form_hidden($hidden);
    }
    if ($csrf_enabled) {
        $form .= form_token();
    }
    return $form;
}

/**
 * Render a link invoking an admin-side "add" action while taking up to two additional URL parameters.
 *
 * @param	string	$event	Event
 * @param	string	$step	Step
 * @param	string	$thing	URL parameter key #1
 * @param	string	$value	URL parameter value #1
 * @param	string	$thing2	URL parameter key #2
 * @param	string	$value2	URL parameter value #2
 * @return			string 	HTML
 */
function aLink($event, $step, $thing, $value, $thing2, $value2)
{
    $o = '<a href="?event=' . $event . a . 'step=' . $step . a . '_txp_token=' . form_token() . a . $thing . '=' . urlencode($value) . a . $thing2 . '=' . urlencode($value2) . '"';
    $o .= ' class="alink">+</a>';
    return $o;
}

" lang="<?php 
echo LANG;
?>
" dir="<?php 
echo txpspecialchars(gTxt('lang_dir'));
?>
">
<head>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
	<title><?php 
echo gTxt('build');
?>
 &#124; Textpattern CMS</title>
	<script type="text/javascript" src="jquery.js"></script>
	<?php 
echo script_js('var textpattern = {event: "' . txpspecialchars($event) . '", step: "' . txpspecialchars($step) . '", _txp_token: "' . txpspecialchars(form_token()) . '"};');
?>
	<?php 
echo $theme->html_head();
?>
	</head>
<body id="tag-event">
<?php 
$tag_name = gps('tag_name');
$functname = 'tag_' . $tag_name;
if (function_exists($functname)) {
    $endform = n . tr(td() . td(fInput('submit', '', gTxt('build')))) . n . endTable() . n . eInput('tag') . n . sInput('build') . n . hInput('tag_name', $tag_name);
    echo $functname($tag_name);
}
?>

/**
 * Renders a widget to select various amounts to page lists by.
 *
 * The rendered options can be changed via a '{$event}_ui > pageby_values'
 * callback event.
 *
 * @param  string      $event Event
 * @param  int         $val   Current setting
 * @param  string|null $step  Step
 * @return string      HTML
 */
function pageby_form($event, $val, $step = null)
{
    $vals = array(15, 25, 50, 100);
    callback_event_ref($event . '_ui', 'pageby_values', 0, $vals);
    if ($step === null) {
        $step = $event . '_change_pageby';
    }
    $out = array();
    foreach ($vals as $qty) {
        if ($qty == $val) {
            $class = 'navlink-active';
            $aria_pressed = 'true';
        } else {
            $class = 'navlink';
            $aria_pressed = 'false';
        }
        $out[] = href($qty, array('event' => $event, 'step' => $step, 'qty' => $qty, '_txp_token' => form_token()), array('class' => $class, 'title' => gTxt('view_per_page', array('{page}' => $qty)), 'aria-pressed' => $aria_pressed, 'role' => 'button'));
    }
    return graf(join('', $out), array('class' => 'nav-tertiary pageby'));
}

?>
<!DOCTYPE html>
<html lang="<?php 
echo LANG;
?>
" dir="<?php 
echo txpspecialchars(gTxt('lang_dir'));
?>
">
<head>
<meta charset="utf-8">
<title><?php 
echo gTxt('build');
?>
 &#124; Textpattern CMS</title><?php 
echo script_js('vendors/jquery/jquery/jquery.js', TEXTPATTERN_SCRIPT_URL) . script_js('vendors/jquery/ui/js/jquery-ui.js', TEXTPATTERN_SCRIPT_URL) . script_js('//code.jquery.com/jquery-migrate-1.2.1.js', TEXTPATTERN_SCRIPT_URL) . script_js('var textpattern = ' . json_encode(array('event' => $event, 'step' => $step, '_txp_token' => form_token(), 'textarray' => (object) null)) . ';') . script_js('textpattern.js', TEXTPATTERN_SCRIPT_URL) . n;
// Mandatory un-themable Textpattern core styles
echo $theme->html_head();
?>
</head>
<body id="tag-event">
<?php 
echo Txp::get('Textpattern_Tag_BuilderTags')->renderTagHelp(gps('tag_name'));
?>
</body>
</html>
<?php 
/**
 * Collection of tag builder functions.
 *
 * @package Admin\Tag

function smd_ebook_buttons($curr = 'mgr')
{
    global $smd_ebook_event;
    $ret = array('btnMgr' => sLink($smd_ebook_event, '', gTxt('smd_ebook_lbl_mgr'), 'navlink' . ($curr === 'mgr' ? ' smd_active' : '')), 'btnPrf' => sLink($smd_ebook_event, 'smd_ebook_prefs', gTxt('smd_ebook_lbl_prf'), 'navlink' . ($curr === 'prf' ? ' smd_active' : '')), 'btnCln' => sLink($smd_ebook_event, 'smd_ebook_tidy', gTxt('smd_ebook_lbl_cln'), 'navlink' . ($curr === 'cln' ? ' smd_active' : '')), 'btnTst' => href(gTxt('smd_ebook_lbl_tst'), 'index.php?event=' . $smd_ebook_event . a . 'step=smd_ebook_test' . a . '_txp_token=' . form_token(), ' class="navlink"'));
    return $ret;
}

 /**
  * Validates a token.
  *
  * @return bool
  */
 protected function valid_token()
 {
     $args = func_get_args();
     return ps('token') === md5(join('', $args) . ps('origin') . form_token() . get_pref('blog_uid'));
 }

function bouncer($step, $steps)
{
    global $event;
    if (empty($step)) {
        return true;
    }
    // Validate step
    if (!array_key_exists($step, $steps)) {
        return false;
    }
    // Does this step require a token?
    if (!$steps[$step]) {
        return true;
    }
    // Validate token
    if (gps('_txp_token') == form_token()) {
        return true;
    }
    // This place ain't no good for you, son.
    die(gTxt('get_off_my_lawn', array('{event}' => $event, '{step}' => $step)));
}

/**
 * Renders the list of preferences.
 *
 * Plugins may add their own prefs, for example by using plugin lifecycle events
 * or raising a (pre) callback on event=admin / step=prefs_list so they are
 * installed or updated when accessing the Preferences panel. Access to the
 * prefs can be controlled by using add_privs() on 'prefs.your-prefs-event-name'.
 *
 * @param string $message The feedback / error string to display
 */
function prefs_list($message = '')
{
    global $prefs, $txp_user;
    extract($prefs);
    pagetop(gTxt('tab_preferences'), $message);
    $locale = setlocale(LC_ALL, $locale);
    echo n . '<form class="prefs-form" id="prefs_form" method="post" action="index.php">';
    // TODO: remove 'custom' when custom fields are refactored.
    $core_events = array('site', 'admin', 'publish', 'feeds', 'comments', 'custom');
    $joined_core = join(',', quote_list($core_events));
    $sql = array();
    $sql[] = 'prefs_id = 1 and event != "" and type in(' . PREF_CORE . ', ' . PREF_PLUGIN . ')';
    $sql[] = "(user_name = '' OR (user_name = '" . doSlash($txp_user) . "' AND name NOT IN (\n            SELECT name FROM " . safe_pfx('txp_prefs') . " WHERE user_name = ''\n        )))";
    if (!get_pref('use_comments', 1, 1)) {
        $sql[] = "event != 'comments'";
    }
    $rs = safe_rows_start("*, FIELD(event, {$joined_core}) AS sort_value", 'txp_prefs', join(" AND ", $sql) . " ORDER BY sort_value = 0, sort_value, event, position");
    $last_event = null;
    $out = array();
    $build = array();
    $groupOut = array();
    if (numRows($rs)) {
        while ($a = nextRow($rs)) {
            if (!has_privs('prefs.' . $a['event'])) {
                continue;
            }
            if ($a['event'] !== $last_event) {
                if ($last_event !== null) {
                    $build[] = tag(hed(gTxt($last_event), 2, array('id' => 'prefs_group_' . $last_event . '-label')) . join(n, $out), 'section', array('class' => 'txp-prefs-group', 'id' => 'prefs_group_' . $last_event, 'aria-labelledby' => 'prefs_group_' . $last_event . '-label'));
                    $groupOut[] = n . tag(href(gTxt($last_event), '#prefs_group_' . $last_event, array('data-txp-pane' => $last_event, 'data-txp-token' => form_token())), 'li');
                }
                $last_event = $a['event'];
                $out = array();
            }
            $label = '';
            if (!in_array($a['html'], array('yesnoradio', 'is_dst'))) {
                $label = $a['name'];
            }
            // TODO: remove exception when custom fields move to meta store.
            $help = '';
            if (strpos($a['name'], 'custom_') === false) {
                $help = $a['name'];
            }
            if ($a['html'] == 'text_input') {
                $size = INPUT_REGULAR;
            } else {
                $size = '';
            }
            $out[] = inputLabel($a['name'], pref_func($a['html'], $a['name'], $a['val'], $size), $label, $help, array('class' => 'txp-form-field', 'id' => 'prefs-' . $a['name']));
        }
    }
    if ($last_event === null) {
        echo graf(gTxt('no_preferences'));
    } else {
        $build[] = tag(hed(gTxt($last_event), 2, array('id' => 'prefs_group_' . $last_event . '-label')) . join(n, $out), 'section', array('class' => 'txp-prefs-group', 'id' => 'prefs_group_' . $last_event, 'aria-labelledby' => 'prefs_group_' . $last_event . '-label'));
        $groupOut[] = n . tag(href(gTxt($last_event), '#prefs_group_' . $last_event, array('data-txp-pane' => $last_event, 'data-txp-token' => form_token())), 'li') . n;
        echo hed(gTxt('tab_preferences'), 1, array('class' => 'txp-heading')) . n . '<div class="txp-layout-4col-cell-1alt">' . wrapGroup('all_preferences', n . tag(join($groupOut), 'ul', array('class' => 'switcher-list')), 'all_preferences');
        if ($last_event !== null) {
            echo graf(fInput('submit', 'Submit', gTxt('save'), 'publish'), array('class' => 'txp-save'));
        }
        echo n . '</div>' . n . '<div class="txp-layout-4col-cell-2-3-4">' . join(n, $build) . n . '</div>' . sInput('prefs_save') . eInput('prefs') . hInput('prefs_id', '1') . tInput();
    }
    echo n . '</form>';
}

function status_link($status, $name, $linktext)
{
    $out = '<a href="index.php?';
    $out .= 'event=plugin&#38;step=switch_status&#38;status=' . $status . '&#38;name=' . urlencode($name) . '&#38;_txp_token=' . form_token() . '"';
    $out .= '>' . $linktext . '</a>';
    return $out;
}

/**
 * Option to sync.
 *
 * @return bool
 */
function rah_blobin_sync()
{
    global $event, $step;
    if (has_privs('rah_blobin_sync')) {
        return href(gTxt('rah_blobin_sync_now'), array('event' => $event, 'step' => $step, 'rah_blobin_sync' => 1, '_txp_token' => form_token()), array('class' => 'navlink'));
    } else {
        return span(gTxt('rah_blobin_sync_now'), array('class' => 'navlink-disabled'));
    }
}