PHP Security::token方法代码示例

 public function action_index()
 {
     $view = View::factory('forgot_password');
     $this->template->content = $view->render();
     if ($this->request->method() === Request::POST) {
         $email = $this->request->post('email');
         $user = new Model_User();
         $password_recovery = new Model_Password_Recovery();
         $unique_email = $user->unique_email($email);
         if ($unique_email === true) {
             throw new Exception("Email is not correct!");
         }
         $view_for_message = View::factory('forgot_password/send_email');
         $user_id = $user->get_id($email);
         $hash = sha1(Security::token());
         $view_for_message->user_id = $user_id;
         $view_for_message->hash = $hash;
         $create_attemp = $password_recovery->create_attemp($email, $user_id, $hash);
         if (!$create_attemp) {
             throw new Exception("Cannot create attemp!");
         }
         Email::connect();
         $to = array($email);
         $from = array('user@localhost', 'admin');
         $subject = 'Password recovery';
         $message = $view_for_message->render();
         $send_email = Email::send($to, $from, $subject, $message, true);
         if (!$send_email) {
             throw new Exception("Cannot send email! \n {$send_email}");
         }
         $this->redirect('/');
     }
 }

 /**
  * Tests Security::token()
  *
  * @test
  * @dataProvider provider_csrf_token
  * @covers Security::token
  */
 public function test_csrf_token($expected, $input, $iteration)
 {
     Security::$token_name = 'token_' . $iteration;
     $this->assertSame(TRUE, $input);
     $this->assertSame($expected, Security::token(FALSE));
     Session::instance()->delete(Security::$token_name);
 }

 public function action_spam()
 {
     $id = (int) $this->request->param('id', 0);
     $question = ORM::factory('Feedback_Question', $id);
     $user_id = $this->user->id;
     if (!$question->loaded()) {
         $this->redirect('manage/feedback');
     }
     $token = Arr::get($_POST, 'token', false);
     $return = Security::xss_clean(Arr::get($_GET, 'r', 'manage/expert'));
     $this->set('return', Url::media($return));
     if ($this->request->method() == Request::POST && Security::token() === $token) {
         $question->is_spam = ($question->is_spam + 1) % 2;
         $question->spam_mod_id = $user_id;
         $question->save();
         if ($question->is_spam == 1) {
             Message::success(i18n::get('The question is marked as spam'));
         } else {
             Message::success(i18n::get('Marked "Spam" is removed from the question'));
         }
         $this->redirect($return);
     } else {
         if ($question->loaded()) {
             $this->set('question', $question)->set('token', Security::token(true));
         } else {
             $this->redirect('manage/expert');
         }
     }
 }

 public function action_delete()
 {
     $id = (int) $this->request->param('id', 0);
     $expert = ORM::factory('Expert', $id);
     if (!$expert->loaded()) {
         $this->redirect('manage/expert');
     }
     $token = Arr::get($_POST, 'token', false);
     if ($this->request->method() == Request::POST && Security::token() === $token) {
         $expert->delete();
         $opinions = ORM::factory('Expert_Opinion')->where('expert_id', '=', $id)->find_all();
         foreach ($opinions as $item) {
             ORM::factory('Expert_Opinion', $item->id)->delete();
         }
         $list = ORM::factory('Expert');
         $paginate = Paginate::factory($list);
         $list = $list->find_all();
         $last_page = $paginate->page_count();
         if ($this->page > $last_page) {
             $this->page = $this->page - 1;
         }
         if ($this->page <= 0) {
             $this->page = 1;
         }
         Message::success(i18n::get('Judge and all his positions removed'));
         $this->redirect('manage/expert/page-' . $this->page);
     } else {
         $this->set('expert', $expert)->set('token', Security::token(true))->set('cancel_url', Url::media('manage/expert/page-' . $this->page));
     }
 }

 public function action_delete()
 {
     $id = (int) $this->request->param('id', 0);
     $expert = ORM::factory('Expert_Opinion', $id);
     if (!$expert->loaded()) {
         $this->redirect('manage/expertopinions');
     }
     $token = Arr::get($_POST, 'token', false);
     if ($this->request->method() == Request::POST && Security::token() === $token) {
         $loger = new Loger('delete', $expert->title);
         $loger->logThis($expert);
         $expert->delete();
         $list = ORM::factory('Expert_Opinion');
         $paginate = Paginate::factory($list);
         $list = $list->find_all();
         $last_page = $paginate->page_count();
         if ($this->page > $last_page) {
             $this->page = $this->page - 1;
         }
         if ($this->page <= 0) {
             $this->page = 1;
         }
         Message::success(i18n::get('The position of the expert removed'));
         $this->redirect('manage/expertopinions/page-' . $this->page);
     } else {
         $this->set('item', $expert)->set('token', Security::token(true))->set('cancel_url', Url::media('manage/expertopinions/page-' . $this->page));
     }
 }

 public function before()
 {
     parent::before();
     // detecting language, setting it
     $this->detect_language();
     $this->set('_language', $this->language);
     // creating and attaching page metadata
     $this->metadata = new Model_Metadata();
     $this->metadata->title(__(Application::instance()->get('title')), false);
     $this->set('_metadata', $this->metadata);
     //TODO: token auth
     /*
             if ($this->request->method() == Request::POST && Arr::get($_POST, 'token', '') !== Security::token())
             {
        throw new HTTP_Exception_403('Wrong token data');
             }
     */
     $this->set('_token', Security::token());
     // Handles return urls, cropping language out of it (will be appended by url.site at redirect time)
     $rr = Request::initial()->uri();
     $rr = trim($rr, '/');
     $rr = explode('/', $rr);
     if (in_array($rr[0], Application::instance()->get('language.list'))) {
         array_shift($rr);
     }
     $rr = implode('/', $rr);
     $this->set('_return', $rr);
     // detecting if user is logged in
     if (method_exists(Auth::instance(), 'auto_login')) {
         Auth::instance()->auto_login();
     }
     $this->user = Auth::instance()->get_user();
     $this->set('_user', $this->user);
 }

 public function action_index()
 {
     $this->template->title = 'Chat';
     $this->template->description = 'Asynchronous chat';
     View::set_global('_token', Security::token(true));
     $this->template->messages = View::factory('messages');
     $this->template->send_message_form = View::factory('send_message_form');
 }

 /**
  * Form Component
  */
 public static function formComponent()
 {
     $_templates = Themes::getTemplates();
     foreach ($_templates as $template) {
         $templates[basename($template, '.template.php')] = basename($template, '.template.php');
     }
     echo '<div class="col-xs-3">' . Form::open() . Form::hidden('csrf', Security::token()) . Form::label('sandbox_form_template', __('Sandbox template', 'sandbox')) . Form::select('sandbox_form_template', $templates, Option::get('sandbox_template'), array('class' => 'form-control')) . Html::br() . Form::submit('sandbox_component_save', __('Save', 'sandbox'), array('class' => 'btn btn-default')) . Form::close() . '</div>';
 }

 public function __construct($field = array(), $render = TRUE)
 {
     if (!isset($field['value'])) {
         $field['value'] = Security::token();
     }
     if (!isset($field['name'])) {
         $field['name'] = 'security_token';
     }
     parent::__construct($field, $render);
 }

 /**
  * Action for logging out the user
  *
  * 	Additional query params can be specified:
  *
  * 		destroy - to completely destroy the session
  * 		all 	- to remove all user tokens (logout from everywhere)
  *
  */
 public function action_logout()
 {
     // Log out only if the token is ok
     if (Security::token() === $this->request->param('token')) {
         $destroy = (bool) $this->request->query('destroy');
         $all = (bool) $this->request->query('all');
         Auth::instance()->logout($destroy, $all);
     }
     $this->request->redirect(Route::url('admin/auth'));
 }

 public static function anti_forgery_token($new = FALSE)
 {
     $session = Session::instance();
     $config = Kohana::$config->load('security');
     $token_name = $config->get('csrf_token_name', 'request-verification-token');
     $csrf_token = $session->get($token_name);
     if ($new === TRUE or !$csrf_token) {
         $csrf_key = $config->get('csrf_key', Security::token(TRUE));
         $csrf_token = Crypto_Hash_Simple::compute_hash($csrf_key);
         $session->set($token_name, $csrf_token);
     }
     return Form::hidden($token_name, $csrf_token, array('id' => $token_name));
 }

 public function action_album_delete()
 {
     $id = (int) $this->request->param('id');
     $exhibit = ORM::factory('Exhibit_Album', $id);
     if (!$exhibit->loaded()) {
         throw new HTTP_Exception_404();
     }
     if ($this->request->method() == Request::POST) {
         if (Security::check(Arr::get($_POST, 'token'))) {
             $exhibit->delete();
             $this->redirect('manage/exhibits');
         }
     }
     $this->set('item', $exhibit)->set('token', Security::token(true));
 }

 public function action_delete()
 {
     $id = (int) $this->request->param('id', 0);
     $type = Arr::get($_GET, 'type', 'slider');
     $token = Arr::get($_POST, 'token', false);
     if ($this->request->method() == Request::POST && Security::token() === $token) {
         $slider = ORM::factory('Slider', $id);
         $loger = new Loger('delete', $slider->link_ru);
         $loger->log($slider);
         $slider->delete();
         $this->redirect('manage/sliders/?type=' . $type);
     } else {
         $this->set('token', Security::token(true))->set('r', Url::media('manage/sliders?type=' . $type));
     }
 }

 public function action_delete()
 {
     $id = (int) $this->request->param('id', 0);
     $token = Arr::get($_POST, 'token', false);
     if ($this->request->method() == Request::POST && Security::token() === $token) {
         ORM::factory('Leader', $id)->delete();
         $this->redirect('manage/leaders');
     } else {
         $leader = ORM::factory('Leader', $id);
         if ($leader->loaded()) {
             $this->set('record', $leader)->set('token', Security::token(true))->set('cancel_url', Url::media('manage/leader'));
         } else {
             throw new HTTP_Exception_404();
         }
     }
 }

 public function action_delete()
 {
     $id = (int) $this->request->param('id', 0);
     $link = ORM::factory('Link', $id);
     if (!$link->loaded()) {
         throw new HTTP_Exception_404();
     }
     $token = Arr::get($_POST, 'token', false);
     if ($this->request->method() == Request::POST && Security::token() === $token) {
         $link->delete();
         Message::success('Удалено');
         $this->redirect('manage/links');
     } else {
         $this->set('record', $link)->set('token', Security::token(true))->set('cancel_url', Url::media('manage/links'));
     }
 }