commit 40a2da38a2b02b7017d75a794714f4c2c2b04e92 Author: Ain <41307858+nero@users.noreply.github.com> Date: Wed Aug 14 19:22:54 2019 +0200 Initial commit diff --git a/CsrfException.php b/CsrfException.php new file mode 100644 index 0000000..d19a438 --- /dev/null +++ b/CsrfException.php @@ -0,0 +1,6 @@ +error=$_FILES[$name]['error']; + $this->value=$_FILES[$name]['name']; + $this->file=$_FILES[$name]['tmp_name']; + } + + public function validate() { + return ($this->error==0); + } +} diff --git a/Form.php b/Form.php new file mode 100644 index 0000000..bbe39c1 --- /dev/null +++ b/Form.php @@ -0,0 +1,47 @@ +fields=$fields; + } + + public function denyCsrf() { + $this->fields["_csrf"]=new HiddenFormField(); + $this->fields["_csrf"]->setValue($this->getCsrfToken()); + } + + public function getEnctype() { + foreach ($this->fields as $name=>$field) { + if ($field instanceof FileUpload) { + return "multipart/form-data"; + } + } + return "application/x-www-form-urlencoded"; + } + + public function reset() { + foreach ($this->fields as $name=>$field) { + $field->reset(); + } + } + + public function loadFromEnv() { + foreach ($this->fields as $name=>$field) { + $field->loadFromEnv($name); + } + if (isset($this->fields['_csrf']) && $this->fields['_csrf']->getValue() !== $this->getCsrfToken()) { + throw new CsrfException(); + } + } + + public static function getCsrfToken() { + if (!isset($_SESSION['csrf'])) { + $_SESSION['csrf']=bin2hex(openssl_random_pseudo_bytes(16)); + } + return $_SESSION['csrf']; + } +} diff --git a/FormField.php b/FormField.php new file mode 100644 index 0000000..735f461 --- /dev/null +++ b/FormField.php @@ -0,0 +1,32 @@ +$v) { + $this->$k = $vars[$k]; + } + } + + public function getValue() { + return $this->value; + } + + public function setValue($val) { + $this->value=$val; + } + + public function validate() { + return true; + } + + public function reset() { + $this->value=""; + } + + public function loadFromEnv($name) { + $this->value=$_POST[$name]; + } +} diff --git a/HiddenFormField.php b/HiddenFormField.php new file mode 100644 index 0000000..c4aa89a --- /dev/null +++ b/HiddenFormField.php @@ -0,0 +1,6 @@ +