PHP access::csrf_token方法代码示例

 public function change_photo_test()
 {
     $controller = new Photos_Controller();
     $root = ORM::factory("item", 1);
     $photo = photo::create($root, MODPATH . "gallery/tests/test.jpg", "test.jpeg", "test", "test", identity::active_user()->id, "slug");
     $orig_name = $photo->name;
     $_POST["filename"] = "test.jpeg";
     $_POST["name"] = "new name";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     $_POST["slug"] = "new-slug";
     $_POST["csrf"] = access::csrf_token();
     access::allow(identity::everybody(), "edit", $root);
     ob_start();
     $controller->update($photo->id);
     $photo->reload();
     $results = ob_get_contents();
     ob_end_clean();
     $this->assert_equal(json_encode(array("result" => "success", "location" => "HTTP_REFERER")), $results);
     $this->assert_equal("new-slug", $photo->slug);
     $this->assert_equal("new title", $photo->title);
     $this->assert_equal("new description", $photo->description);
     // We don't change the name, yet.
     $this->assert_equal($orig_name, $photo->name);
 }

 public function change_album_test()
 {
     $controller = new Albums_Controller();
     $root = ORM::factory("item", 1);
     $this->_album = album::create($root, "test", "test", "test");
     $orig_name = $this->_album->name;
     $_POST["dirname"] = "test";
     $_POST["name"] = "new name";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     $_POST["column"] = "weight";
     $_POST["direction"] = "ASC";
     $_POST["csrf"] = access::csrf_token();
     $_POST["_method"] = "put";
     access::allow(group::everybody(), "edit", $root);
     ob_start();
     $controller->_update($this->_album);
     $results = ob_get_contents();
     ob_end_clean();
     $this->assert_equal(json_encode(array("result" => "success")), $results);
     $this->assert_equal("new title", $this->_album->title);
     $this->assert_equal("new description", $this->_album->description);
     // We don't change the name, yet.
     $this->assert_equal($orig_name, $this->_album->name);
 }

 static function context_menu($menu, $theme, $item, $thumb_css_selector)
 {
     if (hide::can_be_hidden($item) && hide::can_hide($item)) {
         $csrf = access::csrf_token();
         $link = self::_get_hide_link_data($item);
         $menu->get("options_menu")->append(Menu::factory("ajax_link")->label($link["text"])->ajax_handler("function(data) { window.location.reload() }")->url(url::site("display/" . $link["action"] . "/{$item->id}?csrf={$csrf}")));
     }
 }

 function is_admin()
 {
     if (identity::active_user()->admin) {
         json::reply(array("result" => "success", "csrf" => access::csrf_token()));
         return;
     }
     json::reply(array("result" => "failure"));
 }

 function two_hiddens_test()
 {
     $form = new Forge("test/controller", "", "post");
     $form->hidden("HIDDEN_NAME")->value("HIDDEN_VALUE");
     $csrf = access::csrf_token();
     $expected = "<form action=\"http://./index.php/test/controller\" method=\"post\" class=\"form\">\n" . "<input type=\"hidden\" name=\"csrf\" value=\"{$csrf}\"  />" . "<input type=\"hidden\" name=\"HIDDEN_NAME\" value=\"HIDDEN_VALUE\"  />" . "  <ul>\n" . "  </ul>\n" . "</form>";
     $this->assert_same($expected, (string) $form);
 }

 function is_admin()
 {
     if (identity::active_user()->admin) {
         print json_encode(array("result" => "success", "csrf" => access::csrf_token()));
         return;
     }
     print json_encode(array("result" => "failure"));
 }

 static function album($menu, $theme)
 {
     if (!user::active()->guest) {
         $item = $theme->item();
         if ($item) {
             $watching = notification::is_watching($item);
             $menu->append(Menu::factory("link")->id("watch")->label(t("Enable notifications for this album"))->url(url::site("notification/watch/{$item->id}?csrf=" . access::csrf_token()))->css_id($watching ? "gRemoveWatchLink" : "gAddWatchLink"));
         }
     }
 }

 static function context_menu($menu, $theme, $item, $thumb_css_selector)
 {
     $csrf = access::csrf_token();
     $options_menu = $menu->get("options_menu");
     $can_edit = $item && access::can("edit", $item);
     if ($can_edit && $options_menu != null) {
         $cover_title = t("Browse for an album to cover");
         $options_menu->append(Menu::factory("dialog")->id("browse_album_cover")->label($cover_title)->css_class("ui-icon-folder-open")->url(url::site("browse/browse/{$item->id}?csrf={$csrf}")));
     }
 }

 public function index()
 {
     $view = new Admin_View("admin.html");
     $view->content = new View("admin_sidebar.html");
     $view->content->csrf = access::csrf_token();
     $view->content->available = new View("admin_sidebar_blocks.html");
     $view->content->active = new View("admin_sidebar_blocks.html");
     list($view->content->available->blocks, $view->content->active->blocks) = $this->_get_blocks();
     print $view;
 }

 function group_test()
 {
     $form = new Forge("test/controller", "", "post", array("id" => "gTestGroupForm"));
     $group = $form->group("test_group")->label(t("Test Group"));
     $group->input("title")->label(t("Title"));
     $group->textarea("description")->label(t("Text Area"));
     $group->submit("")->value(t("Submit"));
     $rendered = $form->__toString();
     $expected = "<form action=\"http://./index.php/test/controller\" method=\"post\" " . "id=\"gTestGroupForm\">\n" . "<input type=\"hidden\" name=\"csrf\" value=\"" . access::csrf_token() . "\"  />\n" . "  <fieldset>\n" . "    <legend>Test Group</legend>\n" . "    <ul>\n" . "      <li>\n" . "        <label for=\"title\" >Title</label>\n" . "        <input type=\"text\" id=\"title\" name=\"title\" value=\"\" " . "class=\"textbox\"  />\n" . "      </li>\n" . "      <li>\n" . "        <label for=\"description\" >Text Area</label>\n" . "        <textarea id=\"description\" name=\"description\" " . "class=\"textarea\" ></textarea>\n" . "      </li>\n" . "      <li>\n" . "        <input type=\"submit\" value=\"Submit\" class=\"submit\"  />\n" . "      </li>\n" . "    </ul>\n" . "  </fieldset>\n" . "</form>\n";
     $this->assert_same($expected, $rendered);
 }

 static function site_menu($menu, $theme)
 {
     if (!user::active()->guest) {
         $item = $theme->item();
         if ($item && $item->is_album() && access::can("view", $item)) {
             $watching = notification::is_watching($item);
             $label = $watching ? t("Remove notifications") : t("Enable notifications");
             $menu->get("options_menu")->append(Menu::factory("link")->id("watch")->label($label)->css_id("gNotifyLink")->url(url::site("notification/watch/{$item->id}?csrf=" . access::csrf_token())));
         }
     }
 }

 /**
  * Get any pending messages.  There are two types of messages, transient and permanent.
  * Permanent messages are used to let the admin know that there are pending administrative
  * issues that need to be resolved.  Transient ones are only displayed once.
  * @return html text
  */
 static function get()
 {
     $buf = array();
     $messages = Session::instance()->get_once("messages", array());
     foreach ($messages as $msg) {
         $msg[0] = str_replace("__CSRF__", access::csrf_token(), $msg[0]);
         $buf[] = "<li class=\"" . message::severity_class($msg[1]) . "\">{$msg['0']}</li>";
     }
     if ($buf) {
         return "<ul id=\"g-action-status\" class=\"g-message-block\">" . implode("", $buf) . "</ul>";
     }
 }

 static function admin_head($theme)
 {
     $buf = "";
     if (strpos(Router::$current_uri, "admin/server_add") !== false) {
         $buf .= $theme->css("server_add.css") . $theme->css("jquery.autocomplete.css");
         $base = url::site("__ARGS__");
         $csrf = access::csrf_token();
         $buf .= "<script type=\"text/javascript\"> var base_url = \"{$base}\"; var csrf = \"{$csrf}\";</script>";
         $buf .= $theme->script("jquery.autocomplete.js") . $theme->script("admin.js");
     }
     return $buf;
 }

 static function buttons($item, $page_type)
 {
     $elements = array("left" => array(), "center" => array(), "right" => array(), "additional" => array());
     switch ($item->type) {
         case "movie":
             $edit_title = t("Edit this movie");
             $move_title = t("Move this movie to another album");
             $cover_title = t("Choose this movie as the album cover");
             $delete_title = t("Delete this movie");
             break;
         case "album":
             $edit_title = t("Edit this album");
             $move_title = t("Move this album to another album");
             $cover_title = t("Choose this album as the album cover");
             $delete_title = t("Delete this album");
             break;
         default:
             $edit_title = t("Edit this photo");
             $move_title = t("Move this photo to another album");
             $cover_title = t("Choose this photo as the album cover");
             $delete_title = t("Delete this photo");
             break;
     }
     $csrf = access::csrf_token();
     $elements["left"][] = (object) array("title" => $edit_title, "class" => "gDialogLink gButtonLink", "icon" => "ui-icon-pencil", "href" => url::site("quick/form_edit/{$item->id}?page_type={$page_type}"));
     if ($item->is_photo() && graphics::can("rotate")) {
         $elements["left"][] = (object) array("title" => t("Rotate 90 degrees counter clockwise"), "class" => "gButtonLink", "icon" => "ui-icon-rotate-ccw", "href" => url::site("quick/rotate/{$item->id}/ccw?csrf={$csrf}&page_type={$page_type}"));
         $elements["left"][] = (object) array("title" => t("Rotate 90 degrees clockwise"), "class" => "gButtonLink", "icon" => "ui-icon-rotate-cw", "href" => url::site("quick/rotate/{$item->id}/cw?csrf={$csrf}&page_type={$page_type}"));
     }
     // Don't move photos from the photo page; we don't yet have a good way of redirecting after move
     if ($page_type == "album") {
         $elements["left"][] = (object) array("title" => $move_title, "class" => "gDialogLink gButtonLink", "icon" => "ui-icon-folder-open", "href" => url::site("move/browse/{$item->id}"));
     }
     $parent = $item->parent();
     if (access::can("edit", $parent)) {
         // We can't make this item the highlight if it's an album with no album cover, or if it's
         // already the album cover.
         if ($item->type == "album" && empty($item->album_cover_item_id) || $item->type == "album" && $parent->album_cover_item_id == $item->album_cover_item_id || $parent->album_cover_item_id == $item->id) {
             $disabledState = " ui-state-disabled";
         } else {
             $disabledState = " ";
         }
         $elements["right"][] = (object) array("title" => $cover_title, "class" => "gButtonLink{$disabledState}", "icon" => "ui-icon-star", "href" => url::site("quick/make_album_cover/{$item->id}?csrf={$csrf}&page_type={$page_type}"));
         $elements["right"][] = (object) array("title" => $delete_title, "class" => "gDialogLink gButtonLink", "icon" => "ui-icon-trash", "id" => "gQuickDelete", "href" => url::site("quick/form_delete/{$item->id}?csrf={$csrf}&page_type={$page_type}"));
     }
     if ($item->is_album()) {
         $elements["additional"][] = (object) array("title" => t("Add a photo"), "class" => "add_item gDialogLink", "href" => url::site("simple_uploader/app/{$item->id}"));
         $elements["additional"][] = (object) array("title" => t("Add an album"), "class" => "add_album gDialogLink", "href" => url::site("form/add/albums/{$item->id}?type=album"));
         $elements["additional"][] = (object) array("title" => t("Edit permissions"), "class" => "permissions gDialogLink", "href" => url::site("permissions/browse/{$item->id}"));
     }
     return $elements;
 }

 static function admin_head($theme)
 {
     $head = array();
     if (strpos(Router::$current_uri, "admin/server_add") !== false) {
         $head[] = "<link media=\"screen, projection\" rel=\"stylesheet\" type=\"text/css\" href=\"" . url::file("lib/jquery.autocomplete.css") . "\" />";
         $base = url::site("__ARGS__");
         $csrf = access::csrf_token();
         $head[] = "<script> var base_url = \"{$base}\"; var csrf = \"{$csrf}\";</script>";
         $head[] = html::script("lib/jquery.autocomplete.js");
         $head[] = html::script("modules/server_add/js/admin.js");
     }
     return implode("\n", $head);
 }