token.php

<?php
 
define('XOOPS_TOKEN_TIMEOUT', 0);
define('XOOPS_TOKEN_PREFIX', 'XOOPS_TOKEN_');
 
if (!defined('XOOPS_SALT')) {
    define('XOOPS_SALT', substr(md5(XOOPS_DB_PREFIX.XOOPS_DB_USER.XOOPS_ROOT_PATH), 5, 8));
}
 
define('XOOPS_TOKEN_SESSION_STRING', 'X2_TOKEN');
define('XOOPS_TOKEN_MULTI_SESSION_STRING', 'X2_MULTI_TOKEN');
 
define('XOOPS_TOKEN_DEFAULT', 'XOOPS_TOKEN_DEFAULT');

class XoopsToken
{
    public $_name_;

    public $_token_;

    public $_lifetime_;

    public $_unlimited_;

    public $_number_=0;

    public function __construct($name, $timeout = XOOPS_TOKEN_TIMEOUT)
    {
        $this->_name_ = $name;
 
        if ($timeout) {
            $this->_lifetime_ = time() + $timeout;
            $this->_unlimited_ = false;
        } else {
            $this->_lifetime_ = 0;
            $this->_unlimited_ = true;
        }
 
        $this->_token_ = $this->_generateToken();
    }
 

    public function _generateToken()
    {
        mt_srand ((int) microtime() * 10000 );
        return md5(XOOPS_SALT.$this->_name_.uniqid(mt_rand(), true ));
    }

    public function getTokenName()
    {
        return XOOPS_TOKEN_PREFIX.$this->_name_ . '_' . $this->_number_;
    }

    public function getTokenValue()
    {
        return $this->_token_;
    }

    public function setSerialNumber($serial_number)
    {
        $this->_number_ = $serial_number;
    }

    public function getSerialNumber()
    {
        return $this->_number_;
    }

    public function getHtml()
    {
        return @sprintf('<input type="hidden" name="%s" value="%s" />', $this->getTokenName(), $this->getTokenValue());
    }

    public function getUrl()
    {
        return $this->getTokenName() . '=' . $this->getTokenValue();
    }

    public function validate($token=null)
    {
        return ($this->_token_==$token && ($this->_unlimited_ || time()<=$this->_lifetime_));
    }
}

class XoopsTokenHandler
{
    public $_prefix = '';

    public function &create($name, $timeout = XOOPS_TOKEN_TIMEOUT)
    {
        $token =new XoopsToken($name, $timeout);
        $this->register($token);
        return $token;
    }

    public function &fetch($name)
    {
        $ret = null;
        if (isset($_SESSION[XOOPS_TOKEN_SESSION_STRING][$this->_prefix.$name])) {
            $ret =& $_SESSION[XOOPS_TOKEN_SESSION_STRING][$this->_prefix.$name];
        }
        return $ret;
    }

    public function register(&$token)
    {
        $_SESSION[XOOPS_TOKEN_SESSION_STRING][$this->_prefix.$token->_name_] = $token;
    }

    public function unregister(&$token)
    {
        unset($_SESSION[XOOPS_TOKEN_SESSION_STRING][$this->_prefix.$token->_name_]);
    }

    public function isRegistered($name)
    {
        return isset($_SESSION[XOOPS_TOKEN_SESSION_STRING][$this->_prefix.$name]);
    }

    public function validate(&$token, $clearIfValid)
    {
        $req_token = isset($_REQUEST[ $token->getTokenName() ]) ?
                trim($_REQUEST[ $token->getTokenName() ]) : null;
 
        if ($req_token) {
            if ($token->validate($req_token)) {
                if ($clearIfValid) {
                    $this->unregister($token);
                }
                return true;
            }
        }
        return false;
    }
}
 
class XoopsSingleTokenHandler extends XoopsTokenHandler
{
    public function autoValidate($name, $clearIfValid=true)
    {
        if ($token =& $this->fetch($name)) {
            return $this->validate($token, $clearIfValid);
        }
        return false;
    }

    public static function &quickCreate($name, $timeout = XOOPS_TOKEN_TIMEOUT)
    {
        $handler =new XoopsSingleTokenHandler();
        $ret =& $handler->create($name, $timeout);
        return $ret;
    }

    public static function quickValidate($name, $clearIfValid=true)
    {
        $handler = new XoopsSingleTokenHandler();
        return $handler->autoValidate($name, $clearIfValid);
    }
}

class XoopsMultiTokenHandler extends XoopsTokenHandler
{
    public $_prefix = '';
 
    public function &create($name, $timeout=XOOPS_TOKEN_TIMEOUT)
    {
        $token =new XoopsToken($name, $timeout);
        $token->setSerialNumber($this->getUniqueSerial($name));
        $this->register($token);
        return $token;
    }
 
    public function &fetch($name, $serial_number=null)
    {
        $ret = null;
        if (isset($_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$this->_prefix.$name][$serial_number])) {
            $ret =& $_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$this->_prefix.$name][$serial_number];
        }
        return $ret;
    }
 
    public function register(&$token)
    {
        $_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$this->_prefix.$token->_name_][$token->getSerialNumber()] = $token;
    }
 
    public function unregister(&$token)
    {
        unset($_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$this->_prefix.$token->_name_][$token->getSerialNumber()]);
    }
 
    public function isRegistered($name, $serial_number=null)
    {
        return isset($_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$this->_prefix.$name][$serial_number]);
    }
 
    public function autoValidate($name, $clearIfValid=true)
    {
        $serial_number = $this->getRequestNumber($name);
 
        if ((null !== $serial_number) && $token =& $this->fetch($name, $serial_number)) {
            return $this->validate($token, $clearIfValid);
        }
        return false;
    }

    public static function &quickCreate($name, $timeout = XOOPS_TOKEN_TIMEOUT)
    {
        $handler =new XoopsMultiTokenHandler();
        $ret =& $handler->create($name, $timeout);
        return $ret;
    }

    public static function quickValidate($name, $clearIfValid=true)
    {
        $handler = new XoopsMultiTokenHandler();
        return $handler->autoValidate($name, $clearIfValid);
    }

    public function getRequestNumber($name)
    {
        $str = XOOPS_TOKEN_PREFIX.$name . '_';
        foreach ($_REQUEST as $key=>$val) {
            if (preg_match('/' . $str . "(\d+)/", $key, $match)) {
                return (int)$match[1];
            }
        }
 
        return null;
    }
 
    public function getUniqueSerial($name)
    {
        if (isset($_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$name])) {
            if (is_array($_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$name])) {
                for ($i=0;isset($_SESSION[XOOPS_TOKEN_MULTI_SESSION_STRING][$name][$i]);$i++);
                return $i;
            }
        }
 
        return 0;
    }
}