PHP Security::csrf_query方法代码示例

    /**
     * Render view.
     *
     * @return  string
     */
    public function content()
    {
        ob_start();
        if ($this->gallery->links) {
            $links = explode("\n", $this->gallery->links);
            $count = 0;
            ?>

<ul class="list-unstyled">

	<?php 
            foreach ($links as $link) {
                list($user_id, $url) = explode(',', $link, 2);
                ?>
	<li>
		<?php 
                echo HTML::anchor($url, Text::limit_url($url, 75));
                ?>
 &copy; <?php 
                echo HTML::user($user_id);
                ?>
		<?php 
                if (Visitor::$user && $user_id == Visitor::$user->id || Permission::has($this->gallery, Model_Gallery::PERMISSION_UPDATE)) {
                    ?>
		<?php 
                    echo HTML::anchor(Route::model($this->gallery) . '?delete_link=' . $count . '&' . Security::csrf_query(), __('Remove'), array('class' => 'btn btn-danger btn-xs link-delete'));
                    ?>
		<?php 
                }
                ?>
	</li>
	<?php 
                $count++;
            }
            ?>

</ul>

<?php 
        }
        // Add new link
        if (Permission::has($this->gallery, Model_Gallery::PERMISSION_CREATE)) {
            echo HTML::anchor('#add-link', '<i class="fa fa-plus-circle"></i> ' . __('Add link'), array('data-toggle' => 'collapse', 'data-target' => '#form-link'));
            echo $this->form();
        }
        return ob_get_clean();
    }

    /**
     * Render view.
     *
     * @return  string
     */
    public function content()
    {
        ob_start();
        echo Form::open();
        if ($this->venue_duplicate) {
            // Confirm
            $venue = new View_Venue_Info($this->venue);
            $duplicate = new View_Venue_Info($this->venue_duplicate);
            ?>

<div class="col-sm-3">

	<h3><?php 
            echo HTML::anchor(Route::model($this->venue_duplicate), HTML::chars($this->venue_duplicate->name));
            ?>
</h3>
	#<?php 
            echo $this->venue_duplicate->id;
            ?>

	<?php 
            echo $duplicate->content();
            ?>

</div>

<div class="col-sm-1">

	<h3><?php 
            echo __('to');
            ?>
</h3>

</div>

<div class="col-sm-3">

	<h3><?php 
            echo HTML::anchor(Route::model($this->venue), HTML::chars($this->venue->name));
            ?>
</h3>
	#<?php 
            echo $this->venue->id;
            ?>

	<?php 
            echo $venue->content();
            ?>

</div>

<div class="col-sm-1">

	<?php 
            echo HTML::anchor(Route::model($this->venue, 'combine') . '/' . $this->venue_duplicate->id . '?' . Security::csrf_query(), __('Merge'), array('class' => 'btn btn-primary'));
            ?>

</div>

<?php 
        } else {
            // Select duplicate
            echo Form::input_wrap('venue', null, null, __('Combine to'));
            ?>

<script>
	head.ready('anqh', function() {

		var venues = <?php 
            echo json_encode(Model_Venue::factory()->find_all_autocomplete($this->venue->id));
            ?>
;
		$('input[name=venue]').autocompleteVenue({
			source: venues,
			action: function(event, ui) {
				window.location = window.location + '/' + ui.item.id;
			}
		});

	});
</script>

<?php 
        }
        echo Form::close();
        return ob_get_clean();
    }

 /**
  * Edit forum topic
  *
  * @param  integer  $area_id
  * @param  integer  $topic_id
  *
  * @throws  Model_Exception           invalid area, invalid topic
  * @throws  InvalidArgumentException  missing area and topic
  */
 protected function _edit_topic($area_id = null, $topic_id = null)
 {
     $this->history = false;
     $this->view = new View_Page();
     if ($area_id && !$topic_id) {
         // Start new topic
         $mode = View_Forum_PostEdit::NEW_TOPIC;
         /** @var  Model_Forum_Private_Area|Model_Forum_Area  $area */
         $area = $this->private ? Model_Forum_Private_Area::factory($area_id) : Model_Forum_Area::factory($area_id);
         if (!$area->loaded()) {
             throw new Model_Exception($area, $area_id);
         }
         Permission::required($area, Model_Forum_Area::PERMISSION_POST, self::$user);
         $this->view->title = HTML::chars($area->name);
         if ($this->private) {
             $topic = new Model_Forum_Private_Topic();
             $post = new Model_Forum_Private_Post();
             $cancel = Route::url('forum_area', array('id' => 'private', 'action' => ''));
             $recipients = array();
         } else {
             $topic = new Model_Forum_Topic();
             $post = new Model_Forum_Post();
             $cancel = Route::model($area);
         }
     } else {
         if ($topic_id) {
             // Edit old topic
             $mode = View_Forum_PostEdit::EDIT_TOPIC;
             /** @var  Model_Forum_Private_Topic|Model_Forum_Topic  $topic */
             $topic = $this->private ? Model_Forum_Private_Topic::factory($topic_id) : Model_Forum_Topic::factory($topic_id);
             if (!$topic->loaded()) {
                 throw new Model_Exception($topic, $topic_id);
             }
             Permission::required($topic, Model_Forum_Topic::PERMISSION_UPDATE, self::$user);
             // Build recipients list
             if ($this->private) {
                 $recipients = $topic->find_recipient_names();
             }
             $this->view->title_html = Forum::topic($topic);
             $cancel = Route::model($topic);
             // Set actions
             if (Permission::has($topic, Model_Forum_Topic::PERMISSION_DELETE, self::$user)) {
                 $this->view->actions[] = array('link' => Route::model($topic, 'delete') . '?' . Security::csrf_query(), 'text' => '<i class="icon-trash icon-white"></i> ' . __('Delete topic'), 'class' => 'btn btn-danger topic-delete');
             }
         } else {
             throw new InvalidArgumentException('Topic and area missing');
         }
     }
     $errors = array();
     if ($_POST && Security::csrf_valid()) {
         // Get recipients
         if ($this->private) {
             $post_recipients = array();
             foreach (explode(',', Arr::get_once($_POST, 'recipients')) as $recipient) {
                 if ($user = Model_User::find_user_light(trim($recipient))) {
                     $post_recipients[$user['id']] = $user['username'];
                 }
             }
             // Make sure author is included
             $post_recipients[self::$user->id] = self::$user->username;
         }
         if (isset($post)) {
             // New topic
             $post->post = $_POST['post'];
             $post->forum_area_id = $area->id;
             $post->author_id = self::$user->id;
             $post->author_name = self::$user->username;
             $post->author_ip = Request::$client_ip;
             $post->author_host = Request::host_name();
             $post->created = time();
             try {
                 $post->is_valid();
             } catch (Validation_Exception $e) {
                 $errors += $e->array->errors('validate');
             }
             $topic->author_id = self::$user->id;
             $topic->author_name = self::$user->username;
             $topic->name = $_POST['name'];
             $topic->forum_area_id = $area->id;
             $topic->created = time();
             try {
                 $topic->is_valid();
             } catch (Validation_Exception $e) {
                 $errors += $e->array->errors('validate');
             }
             // If no errors found, save models
             if (empty($errors)) {
                 $topic->save();
                 // Recipients
                 if ($this->private) {
                     $topic->set_recipients($post_recipients);
//.........这里部分代码省略.........

 /**
  * Action: tag
  *
  * @param  integer  $group_id
  */
 public function action_tag($group_id = null)
 {
     $this->history = false;
     if ($group_id && $this->request->action() !== 'tag') {
         // Add new tag
         $group = Model_Tag_Group::factory($group_id);
         if (!$group->loaded()) {
             throw new Model_Exception($group, $group_id);
         }
         $tag = Model_Tag::factory();
         $tag->tag_group_id = $group_id;
         $tag->author_id = Visitor::$user->id;
         $tag->created = time();
         $this->view = View_Page::factory($group->name);
         $this->view->subtitle = HTML::chars($group->description);
     } else {
         if ($tag_id = (int) $this->request->param('id')) {
             // Edit old tag
             $tag = Model_Tag::factory($tag_id);
             if (!$tag->loaded()) {
                 throw new Model_Exception($tag, $tag_id);
             }
             $this->view = View_Page::factory($tag->name);
             $this->view->subtitle = HTML::chars($tag->description);
             $this->page_actions[] = array('link' => Route::model($tag, 'delete') . '?' . Security::csrf_query(), 'text' => '<i class="icon-trash icon-white"></i> ' . __('Delete tag'), 'class' => 'btn btn-danger tag-delete');
         } else {
             Request::back(Route::url('tags'));
         }
     }
     $errors = array();
     if ($_POST) {
         $tag->name = Arr::get($_POST, 'name');
         $tag->description = Arr::get($_POST, 'description');
         try {
             $tag->save();
             $this->request->redirect(Route::model($tag));
         } catch (Validation_Exception $e) {
             $errors = $e->array->errors('validate');
         }
     }
     $this->view->add(View_Page::COLUMN_CENTER, $this->section_tag($tag, $errors));
 }

 /**
  * Get venue image.
  *
  * @param   Model_Venue  $venue
  * @return  View_Generic_SideImage
  */
 public function section_venue_image($venue)
 {
     $section = new View_Generic_SideImage($venue->default_image_id ? Model_Image::factory($venue->default_image_id) : null);
     if (Permission::has($venue, Model_Venue::PERMISSION_UPDATE)) {
         $uri = Route::model($venue, 'image');
         $actions = array(HTML::anchor($uri, '<i class="icon-plus-sign icon-white"></i> ' . __('Add image'), array('class' => 'btn btn-mini btn-primary image-add ajaxify')));
         if ($venue->default_image_id) {
             $actions[] = HTML::anchor($uri . '?' . Security::csrf_query() . '&delete=' . $venue->default_image_id, '<i class="icon-trash"></i> ' . __('Delete'), array('class' => 'btn btn-mini image-delete'));
         }
         $section->actions = $actions;
     }
     return $section;
 }