PHP getSecurityToken函数代码示例

 function start_form()
 {
     $this->form .= '<form id="extension__list" accept-charset="utf-8" method="post" action="">';
     $hidden = array('do' => 'admin', 'page' => 'extension', 'sectok' => getSecurityToken());
     $this->add_hidden($hidden);
     $this->form .= '<ul class="extensionList">';
 }

 /**
  * Constructor
  *
  * Sets parameters and autoadds a security token. The old calling convention
  * with up to four parameters is deprecated, instead the first parameter
  * should be an array with parameters.
  *
  * @param   mixed   $params  Parameters for the HTML form element; Using the
  *                           deprecated calling convention this is the ID
  *                           attribute of the form
  * @param   string  $action  (optional, deprecated) submit URL, defaults to
  *                                                  current page
  * @param   string  $method  (optional, deprecated) 'POST' or 'GET', default
  *                                                  is POST
  * @param   string  $enctype (optional, deprecated) Encoding type of the
  *                                                  data
  * @author  Tom N Harris <tnharris@whoopdedo.org>
  */
 function Doku_Form($params, $action = false, $method = false, $enctype = false)
 {
     if (!is_array($params)) {
         $this->params = array('id' => $params);
         if ($action !== false) {
             $this->params['action'] = $action;
         }
         if ($method !== false) {
             $this->params['method'] = strtolower($method);
         }
         if ($enctype !== false) {
             $this->params['enctype'] = $enctype;
         }
     } else {
         $this->params = $params;
     }
     if (!isset($this->params['method'])) {
         $this->params['method'] = 'post';
     } else {
         $this->params['method'] = strtolower($this->params['method']);
     }
     if (!isset($this->params['action'])) {
         $this->params['action'] = '';
     }
     $this->addHidden('sectok', getSecurityToken());
 }

 public function __construct($dataFormat, $responseDataFormat, $environment)
 {
     $this->dataFormat = $dataFormat;
     $this->responseDataFormat = $responseDataFormat;
     $this->environment = $environment;
     $this->securityToken = getSecurityToken($environment);
 }

 /**
  * Creates a new, empty form with some default attributes
  *
  * @param array $attributes
  */
 public function __construct($attributes = array())
 {
     global $ID;
     parent::__construct('form', $attributes);
     // use the current URL as default action
     if (!$this->attr('action')) {
         $get = $_GET;
         if (isset($get['id'])) {
             unset($get['id']);
         }
         $self = wl($ID, $get, false, '&');
         //attributes are escaped later
         $this->attr('action', $self);
     }
     // post is default
     if (!$this->attr('method')) {
         $this->attr('method', 'post');
     }
     // we like UTF-8
     if (!$this->attr('accept-charset')) {
         $this->attr('accept-charset', 'utf-8');
     }
     // add the security token by default
     $this->setHiddenField('sectok', getSecurityToken());
     // identify this as a new form based form in HTML
     $this->addClass('doku_form');
 }

 /**
  * Register the events
  *
  * @param $event DOKU event on ajax call
  * @param $param parameters, ignored
  */
 function _ajax_call(&$event, $param)
 {
     if ($event->data !== 'plugin_explorertree') {
         return;
     }
     //no other ajax call handlers needed
     $event->stopPropagation();
     $event->preventDefault();
     //e.g. access additional request variables
     global $INPUT;
     //available since release 2012-10-13 "Adora Belle"
     if (!checkSecurityToken()) {
         $data = array('error' => true, 'msg' => 'invalid security token!');
     } else {
         switch ($INPUT->str('operation')) {
             case 'explorertree_branch':
                 if (!($helper = plugin_load('helper', 'explorertree'))) {
                     $data = array('error' => true, 'msg' => "Can't load tree helper.");
                     break;
                 }
                 if (!($route = $helper->loadRoute($INPUT->str('route'), $INPUT->arr('loader')))) {
                     $data = array('error' => true, 'msg' => "Can't load route '" . $INPUT->str('route') . "'!");
                 }
                 $data = array('html' => $helper->htmlExplorer($INPUT->str('route'), ltrim(':' . $INPUT->str('itemid')), ':'));
                 if (!$data['html']) {
                     $data['error'] = true;
                     $data['msg'] = "Can't load tree html.";
                 }
                 break;
             case 'callback':
                 if (!($helper = plugin_load('helper', 'explorertree'))) {
                     $data = array('error' => true, 'msg' => "Can't load tree helper.");
                     break;
                 }
                 $route = $helper->loadRoute($INPUT->str('route'), $INPUT->arr('loader'));
                 if (!$route || !is_callable(@$route['callbacks'][$INPUT->str(event)])) {
                     $data = array('error' => true, 'msg' => "Can't load callback '" . $INPUT->str('event') . "'for '" . $INPUT->str('route') . "'!");
                 }
                 $data = @call_user_func_array($route['callbacks'][$INPUT->str(event)], array($INPUT->str('itemid')));
                 if (!is_array($data)) {
                     $data = array('error' => true, 'msg' => "Callback for '" . $INPUT->str('event') . "' does not exists!");
                 }
                 break;
             default:
                 $data = array('error' => true, 'msg' => 'Unknown operation: ' . $INPUT->str('operation'));
                 break;
         }
         //data
         //json library of DokuWiki
     }
     if (is_array($data)) {
         $data['token'] = getSecurityToken();
     }
     require_once DOKU_INC . 'inc/JSON.php';
     $json = new JSON();
     //set content type
     header('Content-Type: application/json');
     echo $json->encode($data);
     //		$this->get_helper()->check_meta_changes();
 }

/**
 * Print a hidden form field with a secret CSRF token
 *
 * @author  Andreas Gohr <andi@splitbrain.org>
 */
function formSecurityToken($print = true)
{
    $ret = '<div class="no"><input type="hidden" name="sectok" value="' . getSecurityToken() . '" /></div>' . "\n";
    if ($print) {
        echo $ret;
    } else {
        return $ret;
    }
}

 function test_form_print()
 {
     $form = $this->_testform();
     ob_start();
     $form->printForm();
     $output = ob_get_contents();
     ob_end_clean();
     $form->addHidden('sectok', getSecurityToken());
     $this->assertEquals($this->_ignoreTagWS($output), $this->_ignoreTagWS($this->_realoutput()));
 }

 /**
  * Constructor
  *
  * Autoadds a security token
  *
  * @param   string  $id     ID attribute of the form.
  * @param   string  $action (optional) submit URL, defaults to DOKU_SCRIPT
  * @param   string  $method (optional) 'POST' or 'GET', default is post
  * @author  Tom N Harris <tnharris@whoopdedo.org>
  */
 function Doku_Form($id, $action = false, $method = false, $enctype = false)
 {
     $this->id = $id;
     $this->action = $action ? $action : script();
     if ($method) {
         $this->method = $method;
     }
     if ($enctype) {
         $this->enctype = $enctype;
     }
     $this->addHidden('sectok', getSecurityToken());
 }

 public function html()
 {
     $abrt = false;
     $next = false;
     echo '<h1>' . $this->getLang('menu') . '</h1>';
     global $conf;
     if ($conf['safemodehack']) {
         $abrt = false;
         $next = false;
         echo $this->locale_xhtml('safemode');
         return;
     }
     $this->_say('<div id="plugin__upgrade">');
     // enable auto scroll
     ?>
     <script language="javascript" type="text/javascript">
         var plugin_upgrade = window.setInterval(function () {
             var obj = document.getElementById('plugin__upgrade');
             if (obj) obj.scrollTop = obj.scrollHeight;
         }, 25);
     </script>
     <?php 
     // handle current step
     $this->_stepit($abrt, $next);
     // disable auto scroll
     ?>
     <script language="javascript" type="text/javascript">
         window.setTimeout(function () {
             window.clearInterval(plugin_upgrade);
         }, 50);
     </script>
     <?php 
     $this->_say('</div>');
     echo '<form action="" method="get" id="plugin__upgrade_form">';
     echo '<input type="hidden" name="do" value="admin" />';
     echo '<input type="hidden" name="page" value="upgrade" />';
     echo '<input type="hidden" name="sectok" value="' . getSecurityToken() . '" />';
     if ($next) {
         echo '<input type="submit" name="step[' . $next . ']" value="' . $this->getLang('btn_continue') . ' ➡" class="button continue" />';
     }
     if ($abrt) {
         echo '<input type="submit" name="step[cancel]" value="✖ ' . $this->getLang('btn_abort') . '" class="button abort" />';
     }
     echo '</form>';
     $this->_progress($next);
 }

 function add_mediamanager_upload_region(&$event)
 {
     global $NS;
     $ext = 'png';
     $default_filename = "screenshot-" . date("Y-m-d_H-i-s") . "." . $ext;
     echo "<!-- SUPA begin -->\n";
     echo "<script type='text/javascript'>\n";
     #echo "alert( 'loading' );";
     echo "addInitEvent(function(){\n";
     echo "  supa_handler.init(\n";
     echo "    '" . addslashes(getSecurityToken()) . "',\n";
     echo "    '" . addslashes($this->getConf("previewscaler")) . "',\n";
     echo "    '" . addslashes($this->getConf("previewwidth")) . "',\n";
     echo "    '" . addslashes($this->getConf("previewheight")) . "',\n";
     echo "    '" . addslashes(hsc($NS)) . "',\n";
     echo "    '" . addslashes($default_filename) . "'\n";
     echo "  );\n";
     echo "});\n";
     echo "</script>\n";
     echo "<!-- SUPA end -->\n";
     return true;
 }

    } else {
        $top_bar = true;
    }
}
?>

<?php 
if (class_exists('Ld_Ui') && method_exists('Ld_Ui', 'top_bar') && $top_bar) {
    ?>
    <?php 
    $loginUrl = Ld_Ui::getAdminUrl(array('module' => 'default', 'controller' => 'auth', 'action' => 'login'));
    if (empty($loginUrl)) {
        $loginUrl = wl($ID, 'do=login&amp;sectok=' . getSecurityToken());
    }
    if (empty($logoutUrl)) {
        $logoutUrl = wl($ID, 'do=logout&amp;sectok=' . getSecurityToken());
    }
    ?>
    <?php 
    Ld_Ui::top_bar(array('loginUrl' => $loginUrl, 'logoutUrl' => $logoutUrl));
} else {
    ?>
  <div class="user-info">
      <?php 
    tpl_userinfo();
    ?>
      <?php 
    tpl_actionlink('subscription');
    ?>
      <?php 
    tpl_actionlink('profile');

 /**
  * Display all currently set permissions in a table
  *
  * @author Andreas Gohr <andi@splitbrain.org>
  */
 function _html_table()
 {
     global $lang;
     global $ID;
     echo '<form action="' . wl() . '" method="post" accept-charset="utf-8"><div class="no">' . NL;
     if ($this->ns) {
         echo '<input type="hidden" name="ns" value="' . hsc($this->ns) . '" />' . NL;
     } else {
         echo '<input type="hidden" name="id" value="' . hsc($ID) . '" />' . NL;
     }
     echo '<input type="hidden" name="acl_w" value="' . hsc($this->who) . '" />' . NL;
     echo '<input type="hidden" name="do" value="admin" />' . NL;
     echo '<input type="hidden" name="page" value="acl" />' . NL;
     echo '<input type="hidden" name="sectok" value="' . getSecurityToken() . '" />' . NL;
     echo '<div class="table">';
     echo '<table class="inline">';
     echo '<tr>';
     echo '<th>' . $this->getLang('where') . '</th>';
     echo '<th>' . $this->getLang('who') . '</th>';
     echo '<th>' . $this->getLang('perm') . '<sup><a id="fnt__1" class="fn_top" href="#fn__1">1)</a></sup></th>';
     echo '<th>' . $lang['btn_delete'] . '</th>';
     echo '</tr>';
     foreach ($this->acl as $where => $set) {
         foreach ($set as $who => $perm) {
             echo '<tr>';
             echo '<td>';
             if (substr($where, -1) == '*') {
                 echo '<span class="aclns">' . hsc($where) . '</span>';
                 $ispage = false;
             } else {
                 echo '<span class="aclpage">' . hsc($where) . '</span>';
                 $ispage = true;
             }
             echo '</td>';
             echo '<td>';
             if ($who[0] == '@') {
                 echo '<span class="aclgroup">' . hsc($who) . '</span>';
             } else {
                 echo '<span class="acluser">' . hsc($who) . '</span>';
             }
             echo '</td>';
             echo '<td>';
             echo $this->_html_checkboxes($perm, $ispage, 'acl[' . $where . '][' . $who . ']');
             echo '</td>';
             echo '<td class="check">';
             echo '<input type="checkbox" name="del[' . hsc($where) . '][]" value="' . hsc($who) . '" />';
             echo '</td>';
             echo '</tr>';
         }
     }
     echo '<tr>';
     echo '<th class="action" colspan="4">';
     echo '<input type="submit" value="' . $lang['btn_update'] . '" name="cmd[update]" class="button" />';
     echo '</th>';
     echo '</tr>';
     echo '</table>';
     echo '</div>';
     echo '</div></form>' . NL;
 }

/**
 * Display the subscribe form
 *
 * @author Adrian Lang <lang@cosmocode.de>
 */
function tpl_subscribe()
{
    global $INFO;
    global $ID;
    global $lang;
    global $conf;
    $stime_days = $conf['subscribe_time'] / 60 / 60 / 24;
    echo p_locale_xhtml('subscr_form');
    echo '<h2>' . $lang['subscr_m_current_header'] . '</h2>';
    echo '<div class="level2">';
    if ($INFO['subscribed'] === false) {
        echo '<p>' . $lang['subscr_m_not_subscribed'] . '</p>';
    } else {
        echo '<ul>';
        foreach ($INFO['subscribed'] as $sub) {
            echo '<li><div class="li">';
            if ($sub['target'] !== $ID) {
                echo '<code class="ns">' . hsc(prettyprint_id($sub['target'])) . '</code>';
            } else {
                echo '<code class="page">' . hsc(prettyprint_id($sub['target'])) . '</code>';
            }
            $sstl = sprintf($lang['subscr_style_' . $sub['style']], $stime_days);
            if (!$sstl) {
                $sstl = hsc($sub['style']);
            }
            echo ' (' . $sstl . ') ';
            echo '<a href="' . wl($ID, array('do' => 'subscribe', 'sub_target' => $sub['target'], 'sub_style' => $sub['style'], 'sub_action' => 'unsubscribe', 'sectok' => getSecurityToken())) . '" class="unsubscribe">' . $lang['subscr_m_unsubscribe'] . '</a></div></li>';
        }
        echo '</ul>';
    }
    echo '</div>';
    // Add new subscription form
    echo '<h2>' . $lang['subscr_m_new_header'] . '</h2>';
    echo '<div class="level2">';
    $ns = getNS($ID) . ':';
    $targets = array($ID => '<code class="page">' . prettyprint_id($ID) . '</code>', $ns => '<code class="ns">' . prettyprint_id($ns) . '</code>');
    $styles = array('every' => $lang['subscr_style_every'], 'digest' => sprintf($lang['subscr_style_digest'], $stime_days), 'list' => sprintf($lang['subscr_style_list'], $stime_days));
    $form = new Doku_Form(array('id' => 'subscribe__form'));
    $form->startFieldset($lang['subscr_m_subscribe']);
    $form->addRadioSet('sub_target', $targets);
    $form->startFieldset($lang['subscr_m_receive']);
    $form->addRadioSet('sub_style', $styles);
    $form->addHidden('sub_action', 'subscribe');
    $form->addHidden('do', 'subscribe');
    $form->addHidden('id', $ID);
    $form->endFieldset();
    $form->addElement(form_makeButton('submit', 'subscribe', $lang['subscr_m_subscribe']));
    html_form('SUBSCRIBE', $form);
    echo '</div>';
}

 /**
  * output appropriate html
  */
 function html()
 {
     global $ID;
     ptln('<h1>' . $this->getLang('menu') . '</h1>');
     $form = new Doku_Form(array('id' => 'vg', 'action' => wl($ID)));
     $form->addHidden('cmd', $this->edit ? 'edit' : 'add');
     $form->addHidden('sectok', getSecurityToken());
     $form->addHidden('page', $this->getPluginName());
     $form->addHidden('do', 'admin');
     $form->startFieldset($this->getLang($this->edit ? 'edituser' : 'adduser'));
     if ($this->edit) {
         $form->addElement(form_makeField('text', 'user', $this->data['user'], $this->getLang('user'), '', '', array('disabled' => 'disabled')));
         $form->addHidden('uid', $this->data['user']);
         $form->addElement('<br />');
     } else {
         $form->addElement(form_makeField('text', 'uid', '', $this->getLang('user')));
         $form->addElement('<br />');
     }
     $form->addElement(form_makeField('text', 'grp', $this->edit ? implode(', ', $this->data['grp']) : '', $this->getLang('grp')));
     $form->addElement('<br />');
     $form->addElement(form_makeButton('submit', '', $this->getLang($this->edit ? 'change' : 'add')));
     $form->endFieldset();
     $form->printForm();
     ptln('<table class="inline" id="vg__show">');
     ptln('  <tr>');
     ptln('    <th class="user">' . hsc($this->getLang('users')) . '</th>');
     ptln('    <th class="grp">' . hsc($this->getLang('grps')) . '</th>');
     ptln('    <th> </th>');
     ptln('  </tr>');
     foreach ($this->users as $user => $grps) {
         //$userdata=$this->_auth->getUserData($user);
         ptln('  <tr>');
         ptln('    <td>' . hsc($user) . (isset($userdata['name']) ? hsc(' (' . $userdata['name'] . ')') : '') . '</td>');
         ptln('    <td>' . hsc(implode(', ', $grps)) . '</td>');
         ptln('    <td class="act">');
         ptln('      <a class="vg_edit" href="' . wl($ID, array('do' => 'admin', 'page' => $this->getPluginName(), 'cmd' => 'edit', 'uid' => $user, 'sectok' => getSecurityToken())) . '">' . hsc($this->getLang('edit')) . '</a>');
         ptln(' &bull; ');
         ptln('      <a class="vg_del" href="' . wl($ID, array('do' => 'admin', 'page' => $this->getPluginName(), 'cmd' => 'del', 'uid' => $user, 'sectok' => getSecurityToken())) . '">' . hsc($this->getLang('del')) . '</a>');
         ptln('    </td>');
         ptln('  </tr>');
     }
     ptln('</table>');
     $form = new Doku_Form(array('id' => 'vg', 'action' => wl($ID)));
     $form->addHidden('cmd', $this->editgroup ? 'editgroup' : 'addgroup');
     $form->addHidden('sectok', getSecurityToken());
     $form->addHidden('page', $this->getPluginName());
     $form->addHidden('do', 'admin');
     if ($this->editgroup) {
         $form->startFieldset($this->getLang('editgroup'));
         $form->addElement(form_makeField('text', 'group', $this->data['group'], $this->getLang('grp'), '', '', array('disabled' => 'disabled')));
         $form->addElement('<br />');
         $form->addHidden('uid', $this->data['group']);
         $form->addElement(form_makeField('text', 'users', implode(', ', $this->data['users']), $this->getLang('users')));
         $form->addElement('<br />');
     } else {
         $form->startFieldset($this->getLang('addgroup'));
         $form->addElement(form_makeField('text', 'uid', '', $this->getLang('grp')));
         $form->addElement('<br />');
         $form->addElement(form_makeField('text', 'users', '', $this->getLang('users')));
         $form->addElement('<br />');
     }
     $form->addElement(form_makeButton('submit', '', $this->getLang($this->editgroup ? 'change' : 'add')));
     $form->endFieldset();
     $form->printForm();
     ptln('<table class="inline" id="vg__show">');
     ptln('  <tr>');
     ptln('    <th class="grp">' . hsc($this->getLang('grps')) . '</th>');
     ptln('    <th class="user">' . hsc($this->getLang('users')) . '</th>');
     ptln('    <th class="act"> </th>');
     ptln('  </tr>');
     foreach ($this->groups as $group => $users) {
         ptln('  <tr>');
         ptln('    <td>' . hsc($group) . '</td>');
         ptln('    <td>' . hsc(implode(', ', $users)) . '</td>');
         ptln('    <td class="act">');
         ptln('      <a class="vg_edit" href="' . wl($ID, array('do' => 'admin', 'page' => $this->getPluginName(), 'cmd' => 'editgroup', 'uid' => $group, 'sectok' => getSecurityToken())) . '">' . hsc($this->getLang('edit')) . '</a>');
         ptln(' &bull; ');
         ptln('      <a class="vg_del" href="' . wl($ID, array('do' => 'admin', 'page' => $this->getPluginName(), 'cmd' => 'delgroup', 'uid' => $group, 'sectok' => getSecurityToken())) . '">' . hsc($this->getLang('del')) . '</a>');
         ptln('    </td>');
         ptln('  </tr>');
     }
     ptln('</table>');
     $form = new Doku_Form(array('id' => 'vg', 'action' => wl($ID)));
     $form->addHidden('cmd', 'search');
     $form->addHidden('sectok', getSecurityToken());
     $form->addHidden('page', $this->getPluginName());
     $form->addHidden('do', 'admin');
     $form->startFieldset($this->getLang('searchuser'));
     $form->addElement(form_makeField('text', 'uid', '', $this->getLang('searchname')));
     $form->addElement(form_makeButton('submit', '', $this->getLang('search')));
     $form->printForm();
     if (!empty($this->_auth_userlist)) {
         ptln('<table class="inline" id="vg__show">');
         ptln('  <tr>');
         ptln('    <th class="user">' . hsc($this->getLang('users')) . '</th>');
         ptln('    <th class="act"> </th>');
         ptln('  </tr>');
//.........这里部分代码省略.........

 /**
  * Display all currently set permissions in a table
  *
  * @author Andreas Gohr <andi@splitbrain.org>
  */
 function _html_table()
 {
     global $lang;
     global $ID;
     echo '<form action="' . wl() . '" method="post" accept-charset="utf-8"><div class="no">' . NL;
     if ($this->ns) {
         echo '<input type="hidden" name="ns" value="' . hsc($this->ns) . '" />' . NL;
     }
     echo '<input type="hidden" name="do" value="admin" />' . NL;
     echo '<input type="hidden" name="page" value="dokutranslate" />' . NL;
     echo '<input type="hidden" name="sectok" value="' . getSecurityToken() . '" />' . NL;
     echo '<table class="inline">';
     echo '<tr>';
     echo '<th>' . $this->getLang('where') . '</th>';
     echo '<th>' . $this->getLang('who') . '</th>';
     echo '<th>' . $lang['btn_delete'] . '</th>';
     echo '</tr>';
     foreach ($this->acl as $where => $who) {
         echo '<tr>';
         echo '<td>';
         echo '<span class="dokutranslatens">' . hsc($where) . '</span>';
         echo '</td>';
         echo '<td>';
         echo '<span class="dokutranslategroup">' . hsc($who) . '</span>';
         echo '</td>';
         echo '<td align="center">';
         echo '<input type="hidden" name="acl[' . hsc($where) . ']" value="' . hsc($who) . '" />';
         echo '<input type="checkbox" name="del[]" value="' . hsc($where) . '" />';
         echo '</td>';
         echo '</tr>';
     }
     echo '<tr>';
     echo '<th align="right" colspan="3">';
     echo '<input type="submit" value="' . $this->getLang('delsel') . '" name="cmd[update]" class="button" />';
     echo '</th>';
     echo '</tr>';
     echo '</table>';
     echo '</div></form>' . NL;
 }