Changeset 751

Timestamp:

Oct 14, 2021 10:54:00 PM (3 years ago)

Author:

anonymous

Message:

Add resetCSRFToken()

File:

• trunk/lib/App.inc.php (modified) (5 diffs)

trunk/lib/App.inc.php

@@ -95 +95 @@
         'csrf_token_enabled' => true,
         // Form tokens will expire after this duration, in seconds.
-        'csrf_token_timeout' => 259200, // 259200 seconds = 3 days.
+        'csrf_token_timeout' => 86400, // 86400 seconds = 24 hours.
         'csrf_token_name' => 'csrf_token',
 
@@ -1407 +1407 @@
     *
     * @access   public
+    * @param    bool    $force_new_token    Generate a new token, replacing any existing token in the session (used by $app->resetCSRFToken())
     * @return   string The new or current csrf_token
     * @author   Quinn Comendant <quinn@strangecode.com>
@@ -1412 +1413 @@
     * @since    15 Nov 2014 17:57:17
     */
-    public function getCSRFToken()
-    {
-        if (!isset($_SESSION['_app'][$this->_ns]['csrf_token']) || (removeSignature($_SESSION['_app'][$this->_ns]['csrf_token']) + $this->getParam('csrf_token_timeout') < time())) {
+    public function getCSRFToken($force_new_token=false)
+    {
+        if ($force_new_token || !isset($_SESSION['_app'][$this->_ns]['csrf_token']) || (removeSignature($_SESSION['_app'][$this->_ns]['csrf_token']) + $this->getParam('csrf_token_timeout') < time())) {
             // No token, or token is expired; generate one and return it.
             return $_SESSION['_app'][$this->_ns]['csrf_token'] = addSignature(time(), null, 64);
@@ -1420 +1421 @@
         // Current token is not expired; return it.
         return $_SESSION['_app'][$this->_ns]['csrf_token'];
+    }
+
+    /*
+    * Generate a new token, replacing any existing token in the session. Call this function after $app->requireValidCSRFToken() for a new token to be required for each request.
+    *
+    * @access   public
+    * @author   Quinn Comendant <quinn@strangecode.com>
+    * @since    14 Oct 2021 17:35:19
+    */
+    public function resetCSRFToken()
+    {
+        $this->getCSRFToken(true);
     }
 
@@ -1427 +1440 @@
     * @access   public
     * @param    string  $user_submitted_csrf_token The user-submitted token to compare with the session token.
-    * @param    string  $csrf_token     The token to compare with the session token.
     * @return   bool    True if the tokens match, false otherwise.
     * @author   Quinn Comendant <quinn@strangecode.com>