PHP User::csrf_cookie方法代码示例

/*
 * Print resize split
 *********************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Subnets = new Subnets($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "split");
# ID must be numeric
if (!is_numeric($_POST['subnetId'])) {
    $Result->show("danger", _("Invalid ID"), true, true);
}
# get subnet details
$subnet = $Subnets->fetch_subnet(null, $_POST['subnetId']);
# verify that user has write permissions for subnet
$subnetPerm = $Subnets->check_permission($User->user, $subnet->id);
if ($subnetPerm < 3) {
    $Result->show("danger", _('You do not have permissions to resize subnet') . '!', true, true);
}
# check if it has slaves - if yes it cannot be splitted!
if ($Subnets->has_slaves($subnet->id)) {
    $Result->show("danger", _('Only subnets that have no nested subnets can be splitted') . "!", true, true);
}

 * Edit switch result
 ***************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database);
$Tools = new Tools($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# strip input tags
$_POST = $Admin->strip_input_tags($_POST);
# validate csrf cookie
$User->csrf_cookie("validate", "vlan_domain", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";
# we cannot delete default domain
if (@$_POST['id'] == 1 && $_POST['action'] == "delete") {
    $Result->show("danger", _("Default domain cannot be deleted"), true);
}
// ID must be numeric
if ($_POST['action'] != "add" && !is_numeric($_POST['id'])) {
    $Result->show("danger", _("Invalid ID"), true);
}
// Hostname must be present
if (@$_POST['name'] == "") {
    $Result->show("danger", _('Name is mandatory') . '!', true);
}
// set sections
if (@$_POST['id'] != 1) {
    foreach ($_POST as $key => $line) {

 * Print edit folder
 *********************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Sections = new Sections($Database);
$Subnets = new Subnets($Database);
$Tools = new Tools($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "folder");
# strip tags - XSS
$_POST = $User->strip_input_tags($_POST);
# validate action
$Admin->validate_action($_POST['action'], true);
# ID must be numeric
if ($_POST['action'] != "add") {
    if (!is_numeric($_POST['subnetId'])) {
        $Result->show("danger", _("Invalid ID"), true, true);
    }
}
# verify that user has permissions to add subnet
if ($_POST['action'] == "add") {
    if ($Sections->check_permission($User->user, $_POST['sectionId']) != 3) {
        $Result->show("danger", _('You do not have permissions to add new subnet in this section') . "!", true, true);
    }

/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Tools = new Tools($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# make sue user can edit
if ($User->is_admin(false) == false && $User->user->editVlan != "Yes") {
    $Result->show("danger", _("Not allowed to change VLANs"), true, true);
}
# create csrf token
$csrf = $User->csrf_cookie("create", "vlan");
# strip tags - XSS
$_POST = $User->strip_input_tags($_POST);
# validate action
$Admin->validate_action($_POST['action'], true);
# fetch vlan details
$vlan = $Admin->fetch_object("vlans", "vlanId", @$_POST['vlanId']);
$vlan = $vlan !== false ? (array) $vlan : array();
# fetch custom fields
$custom = $Tools->fetch_custom_fields('vlans');
# set readonly flag
$readonly = $_POST['action'] == "delete" ? "readonly" : "";
# set form name!
if (isset($_POST['fromSubnet'])) {
    $formId = "vlanManagementEditFromSubnet";
} else {

/*
 * Print resize subnet
 *********************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Subnets = new Subnets($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "resize");
# ID must be numeric
if (!is_numeric($_POST['subnetId'])) {
    $Result->show("danger", _("Invalid ID"), true, true);
}
# verify that user has write permissions for subnet
if ($Subnets->check_permission($User->user, $_POST['subnetId']) < 3) {
    $Result->show("danger", _('You do not have permissions to resize subnet') . '!', true, true);
}
# fetch subnet details
$subnet = (array) $Subnets->fetch_subnet(null, $_POST['subnetId']);
?>

<!-- header -->
<div class="pHeader"><?php 
print _('Resize subnet');

<?php

/**
 * Script to print add / edit / delete group
 *************************************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "group");
# fetch group and set title
if ($_POST['action'] == "add") {
    $title = _('Add new group');
} else {
    //fetch all group details
    $group = (array) $Admin->fetch_object("userGroups", "g_id", $_POST['id']);
    //false die
    $group !== false ?: $Result->show("danger", _("Invalid ID"), true, true);
    $title = ucwords($_POST['action']) . ' ' . _('group') . ' ' . $group['g_name'];
}
?>

<!-- header -->
<div class="pHeader"><?php 
print $title;

/**
 *	Edit powerDNS record
 ************************************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Tools = new Tools($Database);
$Result = new Result();
$PowerDNS = new PowerDNS($Database);
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "record");
# save settings for powerDNS default
$pdns = $PowerDNS->db_settings;
# default post
$post = $_POST;
# get record
if ($_POST['action'] != "add") {
    $record = $PowerDNS->fetch_record($_POST['id']);
    $record !== false ?: $Result->show("danger", _("Invalid ID"), true, true);
} else {
    // from IP table
    // we provide record hostname and strip domain from it
    if (!is_numeric($_POST['domain_id']) && !is_numeric($_POST['id'])) {
        // fetch all domains
        $all_domains = $PowerDNS->fetch_all_domains();
        if ($all_domains !== false) {

<?php

/**
 *	Edit device details
 ************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "device_types");
# ID must be numeric
if ($_POST['action'] != "add" && !is_numeric($_POST['tid'])) {
    $Result->show("danger", _("Invalid ID"), true, true);
}
# set delete flag
$readonly = $_POST['action'] == "delete" ? "readonly" : "";
# fetch device type details
if ($_POST['action'] == "edit" || $_POST['action'] == "delete") {
    $device = $Admin->fetch_object("deviceTypes", "tid", $_POST['tid']);
    # fail if false
    $device === false ? $Result->show("danger", _("Invalid ID"), true) : null;
}
?>

/**
 *	Print all available locations
 ************************************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Tools = new Tools($Database);
$Addresses = new Addresses($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "pstn_number");
# check permissions
if ($Tools->check_prefix_permission($User->user) < 2) {
    $Result->show("danger", _('You do not have permission to manage PSTN numbers'), true, true);
}
# get Location object
if ($_POST['action'] != "add") {
    $number = $Admin->fetch_object("pstnNumbers", "id", $_POST['id']);
    $number !== false ?: $Result->show("danger", _("Invalid ID"), true, true);
    $prefix = $Admin->fetch_object("pstnPrefixes", "id", $number->prefix);
} else {
    # id is required
    if (isset($_POST['id'])) {
        $prefix = $Admin->fetch_object("pstnPrefixes", "id", $_POST['id']);
        $prefix !== false ?: $Result->show("danger", _("Invalid prefix ID"), true, true);
        $number = new StdClass();

 ************************************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database);
$Tools = new Tools($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# get NAT object
$nat = $Admin->fetch_object("nat", "id", $_POST['id']);
$nat !== false ?: $Result->show("danger", _("Invalid ID"), true, true);
// new cookie
$csrf_cookie = $User->csrf_cookie("create", "nat_add");
?>

<!-- header -->
<div class="pHeader"><?php 
print _('Add NAT item');
?>
</div>

<!-- content -->
<div class="pContent">

    <h4><?php 
print _("Search objects");
?>
</h4>

/**
 * Edit rack devices result
 ***************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# strip input tags
$_POST = $Admin->strip_input_tags($_POST);
# validate csrf cookie
$User->csrf_cookie("validate", "rack_devices", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";
# ID must be numeric
if (!is_numeric($_POST['rackid'])) {
    $Result->show("danger", _("Invalid ID"), true);
}
if (!is_numeric($_POST['deviceid'])) {
    $Result->show("danger", _("Invalid ID"), true);
}
if (!is_numeric($_POST['rack_start'])) {
    $Result->show("danger", _("Invalid start value"), true);
}
if (!is_numeric($_POST['rack_size'])) {
    $Result->show("danger", _("Invalid size value"), true);
}
# validate rack
$rack = $Admin->fetch_object("racks", "id", $_POST['rackid']);

/*
 * Print truncate subnet
 *********************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database, false);
$Subnets = new Subnets($Database);
$Addresses = new Addresses($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "truncate");
# id must be numeric
if (!is_numeric($_POST['subnetId'])) {
    $Result->show("danger", _("Invalid ID"), true, true);
}
# get subnet details
$subnet = $Subnets->fetch_subnet(null, $_POST['subnetId']);
# verify that user has write permissions for subnet
$subnetPerm = $Subnets->check_permission($User->user, $subnet->id);
if ($subnetPerm < 3) {
    $Result->show("danger", _('You do not have permissions to resize subnet') . '!', true, true);
}
# set prefix - folder or subnet
$prefix = $subnet->isFolder == "1" ? "folder" : "subnet";
# reformat description
$subnet->description = strlen($subnet->description) > 0 ? "({$subnet->description})" : "";

 *
 * Fetches info from database
 *************************************************/
# include required scripts
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize required objects
$Database = new Database_PDO();
$Result = new Result();
$User = new User($Database);
$Subnets = new Subnets($Database);
$Tools = new Tools($Database);
$Addresses = new Addresses($Database);
# verify that user is logged in
$User->check_user_session();
# create csrf token
$csrf = $User->csrf_cookie("create", "address");
# validate action
$Tools->validate_action($_POST['action']);
# validate post
is_numeric($_POST['subnetId']) ?: $Result->show("danger", _("Invalid ID"), true);
is_numeric($_POST['id']) || strlen($_POST['id']) == 0 ?: $Result->show("danger", _("Invalid ID"), true);
# fetch address and subnet
$address = (array) $Addresses->fetch_address(null, $_POST['id']);
$subnet = (array) $Subnets->fetch_subnet(null, $_POST['subnetId']);
# fetch all slave subnets
$Subnets->fetch_subnet_slaves_recursive($subnet['id']);
?>

<!-- header -->
<div class="pHeader"><?php 
print _('Move IP address to different subnet');

    # initialize user object
    $Database = new Database_PDO();
    $User = new User($Database);
    $Admin = new Admin($Database, false);
    $Subnets = new Subnets($Database);
    $Sections = new Sections($Database);
    $Addresses = new Addresses($Database);
    $Tools = new Tools($Database);
    $Result = new Result();
}
# verify that user is logged in
$User->check_user_session();
# strip input tags
$_POST = $Admin->strip_input_tags($_POST);
# validate csrf cookie
$User->csrf_cookie("validate", "subnet", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";
# if show name than description must be set
if (@$_POST['showName'] == 1 && strlen($_POST['description']) == 0) {
    $Result->show("danger", _("Please enter subnet description to show as name!"), true);
}
# we need old values for mailing
if ($_POST['action'] == "edit" || $_POST['action'] == "delete") {
    $old_subnet_details = (array) $Subnets->fetch_subnet("id", $_POST['subnetId']);
}
# modify post parameters
$_POST['cidr'] = trim($_POST['subnet']);
$_POST['id'] = $_POST['subnetId'];
# get mask and subnet
$temp = explode("/", $_POST['subnet']);
$_POST['mask'] = trim($temp[1]);
$_POST['subnet'] = trim($temp[0]);

<?php

/**
 *	Script to replace fields in IP address list
 ***********************************************/
/* functions */
require dirname(__FILE__) . '/../../../functions/functions.php';
# initialize user object
$Database = new Database_PDO();
$User = new User($Database);
$Admin = new Admin($Database);
$Result = new Result();
# verify that user is logged in
$User->check_user_session();
# validate csrf cookie
$User->csrf_cookie("validate", "replace_fields", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";
//verify post
if (empty($_POST['search'])) {
    $Result->show("danger", _('Please enter something in search field') . '!', true);
}
//if device verify that it exists
if ($_POST['field'] == "switch") {
    if (!($device1 = $Admin->fetch_object("devices", "hostname", $_POST['search']))) {
        $Result->show("danger  alert-absolute", _('Switch') . ' "<i>' . $_POST['search'] . '</i>" ' . _('does not exist, first create switch under admin menu') . '!', true);
    }
    if (!($device2 = $Admin->fetch_object("devices", "hostname", $_POST['replace']))) {
        $Result->show("danger  alert-absolute", _('Switch') . ' "<i>' . $_POST['search'] . '</i>" ' . _('does not exist, first create switch under admin menu') . '!', true);
    }
    //replace posts
    $_POST['search'] = $device1->id;
    $_POST['replace'] = $device2->id;