Project

General

Profile

Download (6.69 KB)

Bug #24697 » 17183_v1.diff

Administrator Admin, 2011-01-21 02:11

View differences:

t3lib/formprotection/class.t3lib_formprotection_frontendformprotection.php (Revision 0)
<?php
/***************************************************************
* Copyright notice
*
* (c) 2010-2011 Oliver Klee <typo3-coding@oliverklee.de>
* All rights reserved
*
* This script is part of the TYPO3 project. The TYPO3 project is
* free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* The GNU General Public License can be found at
* http://www.gnu.org/copyleft/gpl.html.
*
* This script is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
/**
* Class t3lib_formprotection_FrontendFormProtection.
*
* This class provides protection against cross-site request forgery (XSRF/CSRF)
* for forms in the FE.
*
*
* $Id$
*
* @package TYPO3
* @subpackage t3lib
*
* @author Oliver Klee <typo3-coding@oliverklee.de>
*/
class t3lib_formprotection_FrontendFormProtection extends t3lib_formprotection_Abstract {
/**
* the maximum number of tokens that can exist at the same time
*
* @var integer
*/
protected $maximumNumberOfTokens = 20000;
/**
* Keeps the instance of the user which existed during creation
* of the object.
*
* @var tslib_feUserAuth
*/
protected $frontendUser;
/**
* Only allow construction if we have a backend session
*/
public function __construct() {
if (!isset($GLOBALS['TSFE']->fe_user)) {
throw new t3lib_error_Exception(
'A front-end form protection may only be instantiated if there' .
' is an active front-end session.',
1285067843
);
}
$this->frontendUser = $GLOBALS['TSFE']->fe_user;
parent::__construct();
}
/**
* Creates or displayes an error message telling the user that the submitted
* form token is invalid.
*
* @return void
*/
protected function createValidationErrorMessage() {
}
/**
* Retrieves all saved tokens.
*
* @return array<array>
* the saved tokens as, will be empty if no tokens have been saved
*/
protected function retrieveTokens() {
$tokens = $this->frontendUser->getSessionData('formTokens');
if (!is_array($tokens)) {
$tokens = array();
}
$this->tokens = $tokens;
}
/**
* Saves the tokens so that they can be used by a later incarnation of this
* class.
*
* @return void
*/
public function persistTokens() {
$this->frontendUser->setAndSaveSessionData('formTokens', $this->tokens);
}
}
if (defined('TYPO3_MODE') && isset($GLOBALS['TYPO3_CONF_VARS'][TYPO3_MODE]['XCLASS']['t3lib/formprotection/class.t3lib_formprotection_backendformprotection.php'])) {
include_once($GLOBALS['TYPO3_CONF_VARS'][TYPO3_MODE]['XCLASS']['t3lib/formprotection/class.t3lib_formprotection_backendformprotection.php']);
}
?>
t3lib/core_autoload.php (Arbeitskopie)
't3lib_formprotection_factory' => PATH_t3lib . 'formprotection/class.t3lib_formprotection_factory.php',
't3lib_formprotection_abstract' => PATH_t3lib . 'formprotection/class.t3lib_formprotection_abstract.php',
't3lib_formprotection_backendformprotection' => PATH_t3lib . 'formprotection/class.t3lib_formprotection_backendformprotection.php',
't3lib_formprotection_frontendformprotection' => PATH_t3lib . 'formprotection/class.t3lib_formprotection_frontendformprotection.php',
't3lib_formprotection_installtoolformprotection' => PATH_t3lib . 'formprotection/class.t3lib_formprotection_installtoolformprotection.php',
't3lib_formprotection_invalidtokenexception' => PATH_t3lib . 'formprotection/class.t3lib_formprotection_invalidtokenexception.php',
't3lib_localrecordlistgettablehook' => PATH_t3lib . 'interfaces/interface.t3lib_localrecordlistgettablehook.php',
t3lib/class.t3lib_pagerenderer.php (Arbeitskopie)
* @return void
*/
public function addExtDirectCode() {
$formprotection = t3lib_formprotection_Factory::get('t3lib_formprotection_BackendFormProtection');
if (TYPO3_MODE === 'BE') {
$formprotection = t3lib_formprotection_Factory::get('t3lib_formprotection_BackendFormProtection');
} else {
$formprotection = t3lib_formprotection_Factory::get('t3lib_formprotection_FrontendFormProtection');
}
$token = $formprotection->generateToken('extDirect');
$formprotection->persistTokens();
t3lib/extjs/class.t3lib_extjs_extdirectrouter.php (Arbeitskopie)
$token = array_pop($singleRequest->data);
if ($firstCall) {
$firstCall = FALSE;
$formprotection = t3lib_formprotection_Factory::get('t3lib_formprotection_BackendFormProtection');
if (is_object($GLOBALS['BE_USER'])) {
$formprotection = t3lib_formprotection_Factory::get('t3lib_formprotection_BackendFormProtection');
} else {
$formprotection = t3lib_formprotection_Factory::get('t3lib_formprotection_FrontendFormProtection');
}
$validToken = $formprotection->validateToken($token, 'extDirect');
}
typo3/sysext/cms/tslib/class.tslib_extdirecteid.php (Arbeitskopie)
$GLOBALS['LANG'] = t3lib_div::makeInstance('language');
$GLOBALS['LANG']->init();
tslib_eidtools::connectDB();
$GLOBALS['TSFE']->fe_user = tslib_eidtools::initFeUser();
$ajaxID = t3lib_div::_GP('action');
$ajaxScript = $GLOBALS['TYPO3_CONF_VARS']['BE']['AJAX']['ExtDirect::' . $ajaxID];
(1-1/2)