4
4
5
5
namespace Tamedevelopers \Validator \Methods ;
6
6
7
+ use Tamedevelopers \Support \Str ;
7
8
use Tamedevelopers \Support \Tame ;
9
+ use Tamedevelopers \Support \Server ;
8
10
9
11
10
12
class CsrfToken{
@@ -28,7 +30,60 @@ class CsrfToken{
28
30
* @var bool
29
31
*/
30
32
static private $ allow_csrf = true ;
33
+
34
+ /**
35
+ * Create CSRF Session
36
+ *
37
+ * @return void
38
+ */
39
+ static public function initilaizeCSRFSession ()
40
+ {
41
+ if (defined ('GLOBAL_FORM_CSRF_TOKEN ' )){
42
+ self ::$ allow_csrf = GLOBAL_FORM_CSRF_TOKEN ;
43
+ }
31
44
45
+ if (self ::$ allow_csrf ){
46
+ // Start the session if it has not already been started
47
+ if (session_status () == PHP_SESSION_NONE ) {
48
+ @session_start ();
49
+ }
50
+
51
+ // Generate on new page load
52
+ self ::generateTokenOnPageLoad ();
53
+ }
54
+ }
55
+
56
+
57
+ /**
58
+ * __construct
59
+ *
60
+ * @return void
61
+ */
62
+ public function __construct ()
63
+ {
64
+ // self::$session = 'csrf_token';
65
+ // self::$token = bin2hex(random_bytes(32));
66
+
67
+ // // if defined
68
+ // if(defined('GLOBAL_FORM_CSRF_TOKEN')){
69
+ // self::$allow_csrf = GLOBAL_FORM_CSRF_TOKEN;
70
+ // }
71
+
72
+ // // if csrf is allowed to be use
73
+ // if(self::$allow_csrf){
74
+ // // Start the session if it has not already been started
75
+ // if (session_status() == PHP_SESSION_NONE) {
76
+ // @session_start();
77
+ // }
78
+
79
+ // // Generate on new page load
80
+ // self::generateTokenOnPageLoad();
81
+ // }
82
+
83
+ dd (
84
+ 'ss '
85
+ );
86
+ }
32
87
33
88
/**
34
89
* initialize data
@@ -49,7 +104,11 @@ static private function init()
49
104
if (self ::$ allow_csrf ){
50
105
// Start the session if it has not already been started
51
106
if (session_status () == PHP_SESSION_NONE ) {
52
- @session_start ();
107
+ session_start ();
108
+
109
+ dd (
110
+ PHP_SESSION_NONE
111
+ );
53
112
}
54
113
55
114
// Generate on new page load
@@ -68,8 +127,14 @@ static public function getToken()
68
127
69
128
// session
70
129
$ session = isset ($ _SESSION [self ::$ session ])
71
- ? json_decode ($ _SESSION [self ::$ session ], false )
130
+ ? Server:: toObject ($ _SESSION [self ::$ session ])
72
131
: null ;
132
+
133
+
134
+ dd (
135
+ $ session ,
136
+ 'am here '
137
+ );
73
138
74
139
// if session data is available
75
140
if ($ session ) {
@@ -115,6 +180,11 @@ static public function generateCSRFInputToken()
115
180
$ session = self ::$ session ;
116
181
$ token = self ::getToken ();
117
182
183
+ dump (
184
+ $ session ,
185
+ $ token ,
186
+ );
187
+
118
188
if (self ::$ allow_csrf ){
119
189
echo '<input type="hidden" name=" ' .$ session .'" value=" ' .$ token .'"> ' ;
120
190
}
@@ -144,11 +214,14 @@ static private function generateToken()
144
214
static private function generateTokenOnPageLoad ()
145
215
{
146
216
// if csrf is allowed to be use
147
- if (self ::$ allow_csrf ){
148
- if ($ _SERVER ['REQUEST_METHOD ' ] == 'GET ' && empty ($ _GET )) {
149
- unset($ _SESSION [self ::$ session ]);
150
- $ _SESSION [self ::$ session ] = Tame::encryptStr (self ::$ token );
151
- }
217
+ if (self ::$ allow_csrf && empty ($ _REQUEST ['csrf_token ' ]))
218
+ {
219
+ dump (
220
+ 'on load generate ' ,
221
+ session_status ()
222
+ );
223
+ // unset($_SESSION[self::$session]);
224
+ // $_SESSION[self::$session] = Tame::encryptStr(self::$token);
152
225
}
153
226
}
154
227
0 commit comments