Changeset 159 for trunk/lib/Utilities.inc.php

Timestamp:

Jun 11, 2006 5:41:23 AM (18 years ago)

Author:

scdev

Message:

${1}

File:

• trunk/lib/Utilities.inc.php (modified) (5 diffs)

trunk/lib/Utilities.inc.php

@@ -595 +595 @@
  * @access  public
  * @param   string  $val    The string to sign.
- * @param   string  $seed_key   (Optional) A text key to use for computing the signature.
+ * @param   string  $salt   (Optional) A text key to use for computing the signature.
  * @return  string  The original value with a signature appended.
  */
-function addSignature($val, $seed_key=null)
-{
-    $app =& App::getInstance();
-    
-    if ('' == $val) {
-        $app->logMsg(sprintf('Adding signature to empty string.', null), LOG_NOTICE, __FILE__, __LINE__);
-    }
-
-    if (!isset($seed_key)) {
-        $seed_key = $app->getParam('signing_key');
-    }
-
-    return $val . '-' . substr(md5($val . $seed_key), 0, 18);
+function addSignature($val, $salt=null)
+{
+    $app =& App::getInstance();
+    
+    if ('' == trim($val)) {
+        $app->logMsg(sprintf('Cannot add signature to an empty string.', null), LOG_DEBUG, __FILE__, __LINE__);
+        return '';
+    }
+
+    if (!isset($salt)) {
+        $salt = $app->getParam('signing_key');
+    }
+
+    return $val . '-' . substr(md5($salt . md5($val . $salt)), 0, 18);
 }
 
@@ -631 +632 @@
  * @access  public
  * @param   string  $signed_val A value with appended signature.
- * @param   string  $seed_key       (Optional) A text key to use for computing the signature.
+ * @param   string  $salt       (Optional) A text key to use for computing the signature.
  * @return  bool    True if the signature matches the var.
  */
-function verifySignature($signed_val, $seed_key=null)
+function verifySignature($signed_val, $salt=null)
 {
     // Strip the value from the signed value.
     $val = removeSignature($signed_val);
     // If the signed value matches the original signed value we consider the value safe.
-    if ($signed_val == addSignature($val, $seed_key)) {
+    if ($signed_val == addSignature($val, $salt)) {
         // Signature verified.
         return true;
@@ -716 +717 @@
         return false;
     }
-}
-
-/**
- * If the given $url is on the same web site, return true. This can be used to
- * prevent from sending sensitive info in a get query (like the SID) to another
- * domain.
- *
- * @param  string $url    the URI to test.
- * @return bool True if given $url is this domain or has no domain (is a relative url), false if it's another.
- */
-function isMyDomain($url)
-{
-    static $urls = array();
-
-    if (!isset($urls[$url])) {
-        if (!preg_match('|\w{1,}\.\w{2,5}/|', $url)) {
-            // If we can't find a domain we assume the URL is relative.
-            $urls[$url] = true;
-        } else {
-            $urls[$url] = preg_match('/' . preg_quote(getenv('HTTP_HOST')) . '/', $url);
-        }
-    }
-    return $urls[$url];
-}
-
-/**
- * Takes a URL and returns it without the query or anchor portion
- *
- * @param  string $url   any kind of URI
- * @return string        the URI with ? or # and everything after removed
- */
-function stripQuery($url)
-{
-    return preg_replace('![?#].*!', '', $url);
 }
 
@@ -810 +777 @@
 
 /**
+ * If the given $url is on the same web site, return true. This can be used to
+ * prevent from sending sensitive info in a get query (like the SID) to another
+ * domain.
+ *
+ * @param  string $url    the URI to test.
+ * @return bool True if given $url is our domain or has no domain (is a relative url), false if it's another.
+ */
+function isMyDomain($url)
+{
+    static $urls = array();
+
+    if (!isset($urls[$url])) {
+        if (!preg_match('|https?://[\w.]+/|', $url)) {
+            // If we can't find a domain we assume the URL is local (i.e. "/my/url/path/" or "../img/file.jpg").
+            $urls[$url] = true;
+        } else {
+            $urls[$url] = preg_match('|https?://[\w.]*' . preg_quote(getenv('HTTP_HOST'), '|') . '|i', $url);
+        }
+    }
+    return $urls[$url];
+}
+
+/**
+ * Takes a URL and returns it without the query or anchor portion
+ *
+ * @param  string $url   any kind of URI
+ * @return string        the URI with ? or # and everything after removed
+ */
+function stripQuery($url)
+{
+    return preg_replace('![?#].*!', '', $url);
+}
+
+/**
  * Returns a fully qualified URL to the current script, including the query.
  *
@@ -823 +824 @@
  * Compares the current url with the referring url.
  *
- * @param  string  $compary_query  Include the query string in the comparison.
- * @return bool    true if the current script (or specified valid_referer)
- *                 is the referrer. false otherwise.
+ * @param  bool $exclude_query  Remove the query string first before comparing.
+ * @return bool                 True if the current URL is the same as the refering URL, false otherwise.
  */
 function refererIsMe($exclude_query=false)