PHP verify_form_token函数代码示例

 /**
  * Show the contact page
  * @param string $lang
  */
 public function index($lang = "")
 {
     // https://css-tricks.com/serious-form-security/
     $this->to_tpl['errors'] = array();
     $this->to_tpl['success'] = false;
     $this->set_language($lang);
     if ($lang == "sr") {
         $this->template = "contact-sr";
     } else {
         $this->template = "contact-en";
     }
     $this->set_page_name($this->language_titles["contact"][$lang]);
     if (isset($_POST['submit'])) {
         if (verify_form_token('contact')) {
             // Building a whitelist array with keys which will send through the form,
             // no others would be accepted later on
             $whitelist = array('token', 'name', 'email', 'message', 'submit');
             // Building an array with the $_POST-superglobal
             foreach ($_POST as $key => $item) {
                 // Check if the value $key (fieldname from $_POST)
                 // can be found in the whitelisting array,
                 // if not, die with a short message to the hacker
                 if (!in_array($key, $whitelist)) {
                     write_log('Unknown form fields');
                     die("Hack-Attempt detected. Please use only the fields in the form.");
                 }
             }
             // if pass, send email
             $from_name = stripcleantohtml($_POST['name']);
             $from_email = stripcleantohtml($_POST['email']);
             $message = cleantohtml($_POST['message']);
             $errors = $this->check_input($from_name, $from_email, $message);
             if (!empty($errors)) {
                 $this->to_tpl['errors'] = $errors;
                 $this->to_tpl['token'] = $_POST['token'];
                 return;
             }
             $send = $this->phpmailer($from_name, $from_email, $message);
             if ($send === true) {
                 $this->to_tpl['success'] = true;
             } else {
                 var_dump($send);
                 die;
                 //write_log('PHP Mailer error: ' . $send);
             }
         } else {
             write_log('Formtoken');
             die("Hack-Attempt detected.");
         }
         return;
     }
     // Generate a new token for the $_SESSION superglobal
     // and put them in a hidden field
     $this->to_tpl['token'] = generate_form_token('contact');
     return;
 }

/**
* save object info to database
*
* Uses sub-scripts to save different data for different object types.
* No parameters used, only globals, it is included script.
*
* @package CMS
*
* Call:
*		include_once("edit_object.php");
*		save_object();
*/
function save_object()
{
    global $site;
    global $objekt;
    global $class_path;
    global $keel;
    global $tyyp;
    verify_form_token();
    ###################
    # 1. special case: if object is NEW picture
    if ($tyyp['klass'] == "pilt" && !$objekt->objekt_id) {
        include_once "edit_" . $tyyp['klass'] . ".php";
        if (function_exists("save_objekts")) {
            save_objekts(array(tyyp_id => $tyyp[tyyp_id], keel => $keel));
        }
    } else {
        # pealkiri peab olema!
        if ($site->fdat[pealkiri] == '' && $tyyp['klass'] != "kommentaar") {
            $errors .= $site->sys_sona(array(sona => "maaratud pealkiri", tyyp => "editor")) . "<br>";
        }
        ###################
        # Salvestame tyybi parameetrid
        if (file_exists("edit_" . $tyyp['klass'] . ".php")) {
            include_once "edit_" . $tyyp['klass'] . ".php";
            if (function_exists("save_tyyp_params")) {
                $templ_params = save_tyyp_params(array(objekt => $objekt));
            }
        }
        ###################
        # Salvestame malli parameetrid - old ver3 style
        # arvestame, et malli parameetrid k�ivad ainult sisumalli kohta
        $sql = $site->db->prepare("SELECT ttyyp_id, templ_fail FROM templ_tyyp WHERE ttyyp_id = ?", $site->fdat['ttyyp_id']);
        $sth = new SQL($sql);
        $site->debug->msg("EDIT: " . $sth->debug->get_msgs());
        $temp_ttyyp = $sth->fetch();
        if ($temp_ttyyp['templ_fail'] && strpos($temp_ttyyp['templ_fail'], '../') !== 0 && file_exists("../" . $temp_ttyyp['templ_fail'])) {
            include_once "../" . $temp_ttyyp['templ_fail'];
        }
        if (function_exists("save_params")) {
            $templ_params = save_params(array(objekt => $objekt));
        }
        ### ttyyp_params - ver3 style vs ver4. Bug #2506
        if (!empty($templ_params)) {
            $oldstyle_tyyp_params = true;
            # if old-ver-style fixed params are used
        } else {
            # use new ver4 style custom conf save/load by default
            $oldstyle_tyyp_params = false;
        }
        ###################
        # if no errors occured , begin saving to database
        if (!$errors) {
            $site->debug->msg("EDIT: Objekti salvestamine");
            ###################
            # strip HTML tags from headline, lyhi, sisu for strip-fields
            // folder title is folder filesystem name
            if ($site->fdat['tyyp_id'] == 22) {
                $site->fdat['pealkiri'] = safe_filename2($site->fdat['pealkiri']);
            }
            $pealkiri_strip = $site->fdat['pealkiri'];
            $sisu_strip = $site->fdat['scms_article_editor'] ? $site->fdat['scms_article_editor'] : ($site->fdat['sisu'] ? $site->fdat['sisu'] : $site->fdat['text']);
            # replace some tags with space before stripping tags (bug #1568 )
            $replace_tags_arr = array("<br>", "<BR>", "<br />", "<BR />", "&nbsp;");
            $pealkiri_strip = str_replace($replace_tags_arr, " ", $pealkiri_strip);
            $sisu_strip = str_replace($replace_tags_arr, " ", $sisu_strip);
            $replace_tags_arr = array("&amp;");
            $pealkiri_strip = str_replace($replace_tags_arr, "&", $pealkiri_strip);
            $sisu_strip = str_replace($replace_tags_arr, "&", $sisu_strip);
            $pealkiri_strip = strip_tags($pealkiri_strip);
            $sisu_strip = strip_tags($sisu_strip);
            // remove excess spaces
            $sisu_strip = preg_replace('/\\s+/', ' ', $sisu_strip);
            // overwrite catch for files, this is here so when a new file is being uploaded but
            // a file with a same name already exists
            // there wouldn't be double objects
            // instead use the existing object and move on as that objects update
            if ($site->fdat['tyyp_id'] == 21 && $_FILES['fileupload']['name']) {
                $parent_folder = new Objekt(array('objekt_id' => $objekt->parent_id, 'on_sisu' => 1));
                $parent_folder_path = preg_replace('#/$#', '', $site->absolute_path) . $parent_folder->all['relative_path'];
                // delete file
                if (file_exists($parent_folder_path . '/' . safe_filename2($_FILES['fileupload']['name']))) {
                    unlink($parent_folder_path . '/' . safe_filename2($_FILES['fileupload']['name']));
                }
                $file_path = preg_replace('#/$#', '', $site->absolute_path) . $objekt->all['relative_path'];
                // delete the file itself (bug #2586)
                if ($objekt->objekt_id && file_exists($file_path)) {
                    unlink($file_path);
                }
//.........这里部分代码省略.........

        $site->guest->debug->print_msg();
    }
    $site->debug->print_msg();
    ########### EXIT
    exit;
}
# / ACCESS allowed/denied
###########################
# / PERMISSIONS CHECK
####################################
######### GO ON WITH REAL WORK
#################
# STEP2: SAVE DATA
if ($op2 && !$site->fdat['refresh']) {
    $form_error = array();
    verify_form_token();
    ##############
    # SAVE GROUP TAB
    if ($site->fdat['tab'] == 'group') {
        ################## GET profile
        $profile_def = $site->get_profile(array("id" => $site->fdat['profile_id']));
        ################## CHECK & CHANGE profile values (required, date formats, arrays, etc)
        $sql_field_values = check_profile_values(array("profile_def" => &$profile_def, "skip_fields" => "group_id,name,parent_group_id"));
        #printr($sql_field_values);
        ############ NEW OR COPY
        if ($op == 'new' || $op == 'copy') {
            $parent_id = $site->fdat['group_id'];
            $sql = $site->db->prepare("INSERT INTO groups (profile_id, name, parent_group_id, auth_type " . (count($update_fields) ? ',' . join(",", array_keys($sql_field_values)) : '') . ") VALUES (?,?,?,? " . (count($update_fields) ? ",'" . join("','", array_values($sql_field_values)) . "'" : "") . " )", $site->fdat['profile_id'] ? $site->fdat['profile_id'] : 0, trim($site->fdat['name']) == '' ? 'undefined' : $site->fdat['name'], $site->fdat['parent_group_id'], $site->fdat['auth_type']);
            #print $sql;
            $sth = new SQL($sql);
            $site->debug->msg($sth->debug->get_msgs());

function salvesta_objekt()
{
    global $site;
    global $objekt;
    $class_path = "../classes/";
    verify_form_token();
    if ($objekt->objekt_id) {
        if ($objekt->on_sisu_olemas) {
            # -------------------------------
            # Objekti uuendamine andmebaasis
            # -------------------------------
            $sql = $site->db->prepare("update obj_rubriik set on_peida_vmenyy=?, on_printlink=?, on_meilinglist=?, on_alamartiklid=? WHERE objekt_id=?", $objekt->all[on_peida_vmenyy], $site->fdat[on_printlink] ? 1 : 0, $site->fdat[on_meilinglist] ? 1 : 0, $site->fdat[on_alamartiklid] ? 1 : 0, $objekt->objekt_id);
            $sth = new SQL($sql);
            $site->debug->msg($sth->debug->get_msgs());
        } else {
            # -------------------------------
            # Objekti loomine andmebaasis
            # -------------------------------
            $sql = $site->db->prepare("insert into obj_rubriik (objekt_id,on_peida_vmenyy, on_printlink, on_meilinglist, on_alamartiklid) values (?,?,?,?,?)", $objekt->objekt_id, $objekt->all[on_peida_vmenyy], $site->fdat[on_printlink] ? 1 : 0, $site->fdat[on_meilinglist] ? 1 : 0, $site->fdat[on_alamartiklid] ? 1 : 0);
            $sth = new SQL($sql);
            $site->debug->msg($sth->debug->get_msgs());
        }
        $site->debug->msg("sisu on salvestatud, objekt_id = " . $objekt->objekt_id);
    } else {
        $site->debug->msg("sisu pole salvestatud kuna objekt_id puudub");
    }
}

/**
* save permissions to database
*
* Deletes all old values and inserts new ones.
* NB! Used some global variables (doesn't have to be this way later... only for development convienence now)
* 
* @package CMS
* 
* @param string type - permission type (OBJ/ADMIN/ACL/..)
*
* Call:
*		save_permissions(array(
*			"type" => 'OBJ'	
*		));
*/
function save_permissions($args)
{
    global $site;
    global $objekt;
    global $class_path;
    global $keel;
    verify_form_token();
    # if objekt is not created (probably error situation), try to create it again
    if (!$objekt->objekt_id) {
        $objekt = new Objekt(array(objekt_id => $site->fdat['id']));
    }
    if ($args['type']) {
        ############ 1. DELETE ALL OLD PERMISSIONS for object
        $sql = $site->db->prepare("DELETE FROM permissions WHERE type=? AND source_id=?", $args['type'], $site->fdat['id']);
        $sth = new SQL($sql);
        $site->debug->msg($sth->debug->get_msgs());
        #		print "<br>".$sql;
        ############
        # loop over permission rows
        foreach ($site->fdat as $field => $value) {
            if (substr($field, 0, strlen('permission')) == 'permission') {
                # get type (role/group/user) and ID (role_id or group_id or user_id) from fieldname
                list($name, $type, $id) = split("_", $field);
                #print "<br>".$field." => ".$acl. ", ".$type. ", ". $id. " => C:".$site->fdat[$type.'_C_'.$id]." R:".$site->fdat[$type.'_R_'.$id];
                #echo " U:".$site->fdat[$type.'_U_'.$id]; echo " P:".$site->fdat[$type.'_P_'.$id]; echo " D:".$site->fdat[$type.'_D_'.$id];
                #echo " subtree:".$site->fdat[$type.'_S_'.$id];
                ############ 2. INSERT NEW PERMISSIONS for object
                $sql = $site->db->prepare("INSERT INTO permissions (type,source_id,role_id,group_id,user_id,C,R,U,P,D) VALUES (?,?,?,?,?,?,?,?,?,?)", $args['type'], $site->fdat['id'], $type == 'role' ? $id : 0, $type == 'group' ? $id : 0, $type == 'user' ? $id : 0, $site->fdat[$type . '_C_' . $id] ? $site->fdat[$type . '_C_' . $id] : 0, $site->fdat[$type . '_R_' . $id] ? $site->fdat[$type . '_R_' . $id] : 0, $site->fdat[$type . '_U_' . $id] ? $site->fdat[$type . '_U_' . $id] : 0, $site->fdat[$type . '_P_' . $id] ? $site->fdat[$type . '_P_' . $id] : 0, $site->fdat[$type . '_D_' . $id] ? $site->fdat[$type . '_D_' . $id] : 0);
                $sth = new SQL($sql);
                $site->debug->msg($sth->debug->get_msgs());
                #print "<br>".$sql;
            }
            # if permission field
        }
        # / loop over permission rows
        ############
        ############
        # write log
        # type= OBJ
        if ($args['type'] == 'OBJ') {
            new Log(array('action' => 'update', 'component' => 'ACL', 'objekt_id' => $objekt->objekt_id, 'message' => "Object '" . $objekt->all['pealkiri'] . "' (ID=" . $site->fdat['id'] . ") permissions updated"));
        } elseif ($args['type'] == 'ADMIN') {
            #USE FUNCTIONN! POOELLI
            ####### get adminpage name
            $sql = $site->db->prepare("SELECT eng_nimetus FROM admin_osa WHERE id=?", $site->fdat['id']);
            $sth = new SQL($sql);
            $pagename = $sth->fetchsingle();
            $site->debug->msg($sth->debug->get_msgs());
            ####### write log
            new Log(array('action' => 'update', 'component' => 'ACL', 'message' => "Adminpage '" . $pagename . "' permissions updated"));
        }
        # if permission type
        # / write log
        ############
    }
    # if permission type provided
}

function salvesta_objekt_metadata()
{
    global $site;
    verify_form_token();
    $class_path = "../classes/";
    $objekt = new Objekt(array('objekt_id' => $site->fdat['id']));
    if ($objekt->all['objekt_id']) {
        # -------------------------------
        # Objekti uuendamine andmebaasis
        # -------------------------------
        $sql = $site->db->prepare("update objekt set meta_title=?, meta_keywords=?, meta_description=? WHERE objekt_id=?", $site->fdat['meta_title'], $site->fdat['meta_keywords'], $site->fdat['meta_description'], $objekt->objekt_id);
        $sth = new SQL($sql);
        $site->debug->msg($sth->debug->get_msgs());
    } else {
        $site->debug->msg("sisu pole salvestatud kuna objekt_id puudub");
    }
}

function salvesta_objekt()
{
    global $site;
    global $objekt;
    verify_form_token();
    if ($objekt->objekt_id) {
        if ($objekt->on_sisu_olemas) {
            # -------------------------------
            # Objekti uuendamine andmebaasis
            # -------------------------------
            $sql = $site->db->prepare("update obj_rubriik set on_peida_vmenyy=?, on_printlink=?, on_meilinglist=? WHERE objekt_id=?", $objekt->all[on_peida_vmenyy], $site->fdat[on_printlink] ? 1 : 0, $site->fdat[on_meilinglist] ? 1 : 0, $objekt->objekt_id);
            $sth = new SQL($sql);
            $site->debug->msg($sth->debug->get_msgs());
        } else {
            # -------------------------------
            # Objekti loomine andmebaasis
            # -------------------------------
            $sql = $site->db->prepare("insert into obj_rubriik (objekt_id,on_peida_vmenyy, on_printlink, on_meilinglist) values (?,?,?,?)", $objekt->objekt_id, $objekt->all[on_peida_vmenyy], $site->fdat[on_printlink] ? 1 : 0, $site->fdat[on_meilinglist] ? 1 : 0);
            $sth = new SQL($sql);
            $site->debug->msg($sth->debug->get_msgs());
            // Here we make objekt_id like current id (in main window)
            ?>
			<script language=javascript><!--		
				variableFromEditRubriik_id='<?php 
            echo $objekt->objekt_id;
            ?>
';
			//--></script>
<?php 
        }
        $site->debug->msg("sisu on salvestatud, objekt_id = " . $objekt->objekt_id);
        #$site->debug->print_hash($site->fdat,1,"FDAT");
    } else {
        $site->debug->msg("sisu pole salvestatud kuna objekt_id puudub");
    }
    ############################
    ### image and thumb generation
    if ($site->fdat['old_tn_size'] != $site->fdat['tn_size'] || $site->fdat['old_path'] != $site->fdat['path'] || $site->fdat['old_pic_size'] != $site->fdat['pic_size'] || $site->fdat['op2'] == 'save') {
        if ($site->fdat['path']) {
            global $class_path;
            include_once $class_path . 'picture.inc.php';
            generate_images($site->absolute_path . $site->fdat['path'], $site->fdat['tn_size'], $site->fdat['pic_size']);
        }
    }
    ### end image and thumb generation
    ############################
}

function salvesta_objekt()
{
    global $site;
    global $objekt;
    $class_path = "../classes/";
    verify_form_token();
    # -----------------------------
    # lyhi ja sisu koristamine
    # -----------------------------
    # ------
    # SISU
    # ------
    $sisu = $site->fdat['scms_article_editor'];
    //printr(htmlspecialchars($site->fdat['scms_article_editor']));
    //$hostname = ($site->CONF['protocol'] ? $site->CONF['protocol'] : "http://").$site->CONF['hostname'].$site->CONF['wwwroot'].$site->CONF['file_path'].'/';
    $hostname = (empty($_SERVER['HTTPS']) ? 'http://' : 'https://') . $site->CONF['hostname'] . $site->CONF['wwwroot'] . '/';
    # asendada piltidel abosluutne tee  koodiga "##saurus649code##"
    $pattern1 = "|" . '(src\\s*=\\s*[\\"\']?)' . $hostname . "|i";
    $pattern2 = "|" . '(background\\s*=\\s*[\\"\']?)' . $hostname . "|i";
    # asendada failidel abosluutne tee  koodiga "##saurus649code##"
    $pattern3 = "|" . '(href\\s*=\\s*[\\"\']?)' . $hostname . "|i";
    $sisu = preg_replace($pattern1, "\\1" . "##saurus649code##" . '/', $sisu);
    $sisu = preg_replace($pattern2, "\\1" . "##saurus649code##" . '/', $sisu);
    $sisu = preg_replace($pattern3, "\\1" . "##saurus649code##" . '/', $sisu);
    $lyhi = '';
    ## search for LEAD tag and divide content into 2 fields in teh database: lyhi and sisu
    if (strpos($sisu, '<hr class="scms_lead_body_separator" />') !== false) {
        $sisu = explode('<hr class="scms_lead_body_separator" />', $sisu);
        $lyhi = $sisu[0];
        $sisu = $sisu[1];
    }
    if (strpos($sisu, '<hr class="scms_lead_body_separator">') !== false) {
        $sisu = explode('<hr class="scms_lead_body_separator">', $sisu);
        $lyhi = $sisu[0];
        $sisu = $sisu[1];
    }
    //Sisu
    $site->debug->msg('sisu: ' . $sisu);
    $site->debug->msg('pattern: ' . $pattern1);
    $site->debug->msg('pattern: ' . $pattern2);
    $site->debug->msg('pattern: ' . $pattern3);
    $site->debug->msg('sisu: ' . $sisu);
    if ($objekt->objekt_id) {
        // form allowed mails check/insert bug #2277
        // teststring: value="merle@saurus.ee|||index.php?id=26675|||index.php?id=26674|||midagimidagi
        if (preg_match_all('/<input(.*?)>/', $lyhi . $sisu, $matches)) {
            $systemfields = array();
            foreach ($matches[0] as $match) {
                if (strpos($match, 'type="hidden"') && strpos($match, 'name="systemfield"')) {
                    $systemfields[] = $match;
                }
            }
            foreach ($systemfields as $key => $systemfield) {
                if (preg_match('/value="(.*?)\\|\\|\\|(.*?)\\|\\|\\|(.*?)\\|\\|\\|/', $systemfield, $matches)) {
                    // delete form id from objekt_id_list
                    $sql = "select id, objekt_id_list from allowed_mails where objekt_id_list like '%" . $objekt->objekt_id . '_' . $key . "%';";
                    $result = new SQL($sql);
                    while ($row = $result->fetch('ASSOC')) {
                        if ($row['objekt_id_list']) {
                            $row['objekt_id_list'] = explode(',', $row['objekt_id_list']);
                        } else {
                            $row['objekt_id_list'] = array();
                        }
                        if ($row['id']) {
                            unset($row['objekt_id_list'][array_search($objekt->objekt_id . '_' . $key, $row['objekt_id_list'])]);
                            $sql = $site->db->prepare('update allowed_mails set objekt_id_list = ? where id = ?;', implode(',', $row['objekt_id_list']), $row['id']);
                            new SQL($sql);
                        }
                    }
                    // /delete form id from objekt_id_list
                    $sql = $site->db->prepare('select id, objekt_id_list from allowed_mails where mail = ?;', trim($matches[1]));
                    $result = new SQL($sql);
                    $result = $result->fetch('ASSOC');
                    $mail_id = $result['id'];
                    if ($result['objekt_id_list']) {
                        $objekt_id_list = explode(',', $result['objekt_id_list']);
                    } else {
                        $objekt_id_list = array();
                    }
                    // insert id
                    if (!$mail_id) {
                        $sql = $site->db->prepare('insert into allowed_mails (mail, objekt_id_list) values (?, ?);', trim($matches[1]), $objekt->objekt_id . '_' . $key);
                        $result = new SQL($sql);
                        $mail_id = $result->insert_id;
                    }
                    //insert objekt_id, in obj_id_list
                    $objekt_id_list[] = $objekt->objekt_id . '_' . $key;
                    $sql = $site->db->prepare('update allowed_mails set objekt_id_list = ? where id = ?;', implode(',', $objekt_id_list), $mail_id);
                    new SQL($sql);
                    //replace mail address with allowed mails row id
                    $lyhi = str_replace('value="' . $matches[1] . '|||', 'value="' . $mail_id . '|||', $lyhi);
                    $sisu = str_replace('value="' . $matches[1] . '|||', 'value="' . $mail_id . '|||', $sisu);
                }
            }
        }
        // /form allowed mails check/insert
        if ($objekt->on_sisu_olemas) {
            # -------------------------------
            # Objekti uuendamine andmebaasis
            # -------------------------------
//.........这里部分代码省略.........

/**
 * This source file is is part of Saurus CMS content management software.
 * It is licensed under MPL 1.1 (http://www.opensource.org/licenses/mozilla1.1.php).
 * Copyright (C) 2000-2010 Saurused Ltd (http://www.saurus.info/).
 * Redistribution of this file must retain the above copyright notice.
 * 
 * Please note that the original authors never thought this would turn out
 * such a great piece of software when the work started using Perl in year 2000.
 * Due to organic growth, you may find parts of the software being
 * a bit (well maybe more than a bit) old fashioned and here's where you can help.
 * Good luck and keep your open source minds open!
 * 
 * @package		SaurusCMS
 * @copyright	2000-2010 Saurused Ltd (http://www.saurus.info/)
 * @license		Mozilla Public License 1.1 (http://www.opensource.org/licenses/mozilla1.1.php)
 * 
 */
function smarty_function_verify_form_token($params, &$smarty)
{
    verify_form_token();
}