enwikipedia-acc / waca

includes/Validation/ValidationError.php

Indentation +89 added lines, -89 removed lines

@@ -12,99 +12,99 @@
 
 class ValidationError
 {
-    const NAME_EMPTY = "name_empty";
-    const NAME_EXISTS = "name_exists";
-    const NAME_EXISTS_SUL = "name_exists";
-    const NAME_NUMONLY = "name_numonly";
-    const NAME_INVALIDCHAR = "name_invalidchar";
-    const NAME_SANITISED = "name_sanitised";
-    const EMAIL_EMPTY = "email_empty";
-    const EMAIL_WIKIMEDIA = "email_wikimedia";
-    const EMAIL_INVALID = "email_invalid";
-    const EMAIL_MISMATCH = "email_mismatch";
-    const OPEN_REQUEST_NAME = "open_request_name";
-    const BANNED = "banned";
-    const BANNED_TOR = "banned_tor";
-    /**
-     * @var array Error text for the above
-     */
-    private static $errorText = array(
-        self::NAME_EMPTY        => 'You\'ve not chosen a username!',
-        self::NAME_EXISTS       => 'I\'m sorry, but the username you selected is already taken. Please try another. '
-            . 'Please note that Wikipedia automatically capitalizes the first letter of any user name, therefore '
-            . '[[User:example]] would become [[User:Example]].',
-        self::NAME_EXISTS_SUL   => 'I\'m sorry, but the username you selected is already taken. Please try another. '
-            . 'Please note that Wikipedia automatically capitalizes the first letter of any user name, therefore '
-            . '[[User:example]] would become [[User:Example]].',
-        self::NAME_NUMONLY      => 'The username you chose is invalid: it consists entirely of numbers. Please retry '
-            . 'with a valid username.',
-        self::NAME_INVALIDCHAR  => 'There appears to be an invalid character in your username. Please note that the '
-            . 'following characters are not allowed: <code># @ / &lt; &gt; [ ] | { }</code>',
-        self::NAME_SANITISED    => 'Your requested username has been automatically adjusted due to technical '
-            . 'restrictions. Underscores have been replaced with spaces, and the first character has been capitalised.',
-        self::EMAIL_EMPTY       => 'You need to supply an email address.',
-        self::EMAIL_WIKIMEDIA   => 'Please provide your email address here.',
-        self::EMAIL_INVALID     => 'Invalid E-mail address supplied. Please check you entered it correctly.',
-        self::EMAIL_MISMATCH    => 'The email addresses you entered do not match. Please try again.',
-        self::OPEN_REQUEST_NAME => 'There is already an open request with this name in this system.',
-        self::BANNED            => 'I\'m sorry, but you are currently banned from requesting accounts using this tool. '
-            . 'However, you can still send an email to accounts-enwiki-l@lists.wikimedia.org to request an account.',
-        self::BANNED_TOR        => 'Tor exit nodes are currently banned from using this tool due to excessive abuse. '
-            . 'Please note that Tor is also currently banned from editing Wikipedia.',
-    );
-    /**
-     * Summary of $errorCode
-     * @var string
-     */
-    private $errorCode;
-    /**
-     * Summary of $isError
-     * @var bool
-     */
-    private $isError;
+	const NAME_EMPTY = "name_empty";
+	const NAME_EXISTS = "name_exists";
+	const NAME_EXISTS_SUL = "name_exists";
+	const NAME_NUMONLY = "name_numonly";
+	const NAME_INVALIDCHAR = "name_invalidchar";
+	const NAME_SANITISED = "name_sanitised";
+	const EMAIL_EMPTY = "email_empty";
+	const EMAIL_WIKIMEDIA = "email_wikimedia";
+	const EMAIL_INVALID = "email_invalid";
+	const EMAIL_MISMATCH = "email_mismatch";
+	const OPEN_REQUEST_NAME = "open_request_name";
+	const BANNED = "banned";
+	const BANNED_TOR = "banned_tor";
+	/**
+	 * @var array Error text for the above
+	 */
+	private static $errorText = array(
+		self::NAME_EMPTY        => 'You\'ve not chosen a username!',
+		self::NAME_EXISTS       => 'I\'m sorry, but the username you selected is already taken. Please try another. '
+			. 'Please note that Wikipedia automatically capitalizes the first letter of any user name, therefore '
+			. '[[User:example]] would become [[User:Example]].',
+		self::NAME_EXISTS_SUL   => 'I\'m sorry, but the username you selected is already taken. Please try another. '
+			. 'Please note that Wikipedia automatically capitalizes the first letter of any user name, therefore '
+			. '[[User:example]] would become [[User:Example]].',
+		self::NAME_NUMONLY      => 'The username you chose is invalid: it consists entirely of numbers. Please retry '
+			. 'with a valid username.',
+		self::NAME_INVALIDCHAR  => 'There appears to be an invalid character in your username. Please note that the '
+			. 'following characters are not allowed: <code># @ / &lt; &gt; [ ] | { }</code>',
+		self::NAME_SANITISED    => 'Your requested username has been automatically adjusted due to technical '
+			. 'restrictions. Underscores have been replaced with spaces, and the first character has been capitalised.',
+		self::EMAIL_EMPTY       => 'You need to supply an email address.',
+		self::EMAIL_WIKIMEDIA   => 'Please provide your email address here.',
+		self::EMAIL_INVALID     => 'Invalid E-mail address supplied. Please check you entered it correctly.',
+		self::EMAIL_MISMATCH    => 'The email addresses you entered do not match. Please try again.',
+		self::OPEN_REQUEST_NAME => 'There is already an open request with this name in this system.',
+		self::BANNED            => 'I\'m sorry, but you are currently banned from requesting accounts using this tool. '
+			. 'However, you can still send an email to accounts-enwiki-l@lists.wikimedia.org to request an account.',
+		self::BANNED_TOR        => 'Tor exit nodes are currently banned from using this tool due to excessive abuse. '
+			. 'Please note that Tor is also currently banned from editing Wikipedia.',
+	);
+	/**
+	 * Summary of $errorCode
+	 * @var string
+	 */
+	private $errorCode;
+	/**
+	 * Summary of $isError
+	 * @var bool
+	 */
+	private $isError;
 
-    /**
-     * Summary of __construct
-     *
-     * @param string $errorCode
-     * @param bool   $isError
-     */
-    public function __construct($errorCode, $isError = true)
-    {
-        $this->errorCode = $errorCode;
-        $this->isError = $isError;
-    }
+	/**
+	 * Summary of __construct
+	 *
+	 * @param string $errorCode
+	 * @param bool   $isError
+	 */
+	public function __construct($errorCode, $isError = true)
+	{
+		$this->errorCode = $errorCode;
+		$this->isError = $isError;
+	}
 
-    /**
-     * Summary of getErrorCode
-     * @return string
-     */
-    public function getErrorCode()
-    {
-        return $this->errorCode;
-    }
+	/**
+	 * Summary of getErrorCode
+	 * @return string
+	 */
+	public function getErrorCode()
+	{
+		return $this->errorCode;
+	}
 
-    /**
-     * @return string
-     * @throws Exception
-     */
-    public function getErrorMessage()
-    {
-        $text = self::$errorText[$this->errorCode];
+	/**
+	 * @return string
+	 * @throws Exception
+	 */
+	public function getErrorMessage()
+	{
+		$text = self::$errorText[$this->errorCode];
 
-        if ($text == null) {
-            throw new Exception('Unknown validation error');
-        }
+		if ($text == null) {
+			throw new Exception('Unknown validation error');
+		}
 
-        return $text;
-    }
+		return $text;
+	}
 
-    /**
-     * Summary of isError
-     * @return bool
-     */
-    public function isError()
-    {
-        return $this->isError;
-    }
+	/**
+	 * Summary of isError
+	 * @return bool
+	 */
+	public function isError()
+	{
+		return $this->isError;
+	}
 }

includes/Security/Token.php

Indentation +69 added lines, -69 removed lines

@@ -12,80 +12,80 @@
 
 class Token
 {
-    /** @var string */
-    private $tokenData;
-    /** @var string */
-    private $context;
-    /** @var DateTimeImmutable */
-    private $generationTimestamp;
-    /** @var DateTimeImmutable */
-    private $usageTimestamp;
-    /** @var bool */
-    private $used;
+	/** @var string */
+	private $tokenData;
+	/** @var string */
+	private $context;
+	/** @var DateTimeImmutable */
+	private $generationTimestamp;
+	/** @var DateTimeImmutable */
+	private $usageTimestamp;
+	/** @var bool */
+	private $used;
 
-    /**
-     * Token constructor.
-     *
-     * @param string $tokenData
-     * @param string $context
-     */
-    public function __construct($tokenData, $context)
-    {
-        $this->tokenData = $tokenData;
-        $this->context = $context;
-        $this->generationTimestamp = new DateTimeImmutable();
-        $this->usageTimestamp = null;
-        $this->used = false;
-    }
+	/**
+	 * Token constructor.
+	 *
+	 * @param string $tokenData
+	 * @param string $context
+	 */
+	public function __construct($tokenData, $context)
+	{
+		$this->tokenData = $tokenData;
+		$this->context = $context;
+		$this->generationTimestamp = new DateTimeImmutable();
+		$this->usageTimestamp = null;
+		$this->used = false;
+	}
 
-    /**
-     * @return DateTimeImmutable
-     */
-    public function getGenerationTimestamp()
-    {
-        return $this->generationTimestamp;
-    }
+	/**
+	 * @return DateTimeImmutable
+	 */
+	public function getGenerationTimestamp()
+	{
+		return $this->generationTimestamp;
+	}
 
-    /**
-     * @return string
-     */
-    public function getContext()
-    {
-        return $this->context;
-    }
+	/**
+	 * @return string
+	 */
+	public function getContext()
+	{
+		return $this->context;
+	}
 
-    /**
-     * @return string
-     */
-    public function getTokenData()
-    {
-        return $this->tokenData;
-    }
+	/**
+	 * @return string
+	 */
+	public function getTokenData()
+	{
+		return $this->tokenData;
+	}
 
-    /**
-     * Returns a value indicating whether the token has already been used or not
-     *
-     * @return boolean
-     */
-    public function isUsed()
-    {
-        return $this->used;
-    }
+	/**
+	 * Returns a value indicating whether the token has already been used or not
+	 *
+	 * @return boolean
+	 */
+	public function isUsed()
+	{
+		return $this->used;
+	}
 
-    /**
-     * Marks the token as used
-     */
-    public function markAsUsed()
-    {
-        $this->used = true;
-        $this->usageTimestamp = new DateTimeImmutable();
-    }
+	/**
+	 * Marks the token as used
+	 */
+	public function markAsUsed()
+	{
+		$this->used = true;
+		$this->usageTimestamp = new DateTimeImmutable();
+	}
 
-    /**
-     * @return DateTimeImmutable
-     */
-    public function getUsageTimestamp()
-    {
-        return $this->usageTimestamp;
-    }
+	/**
+	 * @return DateTimeImmutable
+	 */
+	public function getUsageTimestamp()
+	{
+		return $this->usageTimestamp;
+	}
 }
\ No newline at end of file

includes/Security/SecurityConfiguration.php

Indentation +182 added lines, -182 removed lines

@@ -15,186 +15,186 @@
  */
 final class SecurityConfiguration
 {
-    const ALLOW = "allow";
-    const DENY = "deny";
-    private $admin = "default";
-    private $user = "default";
-    private $checkuser = "default";
-    private $community = "default";
-    private $suspended = "default";
-    private $declined = "default";
-    private $new = "default";
-    private $requireIdentified;
-
-    /**
-     * Sets whether a checkuser is able to gain access.
-     *
-     * This is private because it's DANGEROUS. Checkusers are not mutually-exclusive with other rights. As such, a
-     * suspended checkuser who tries to access a page which allows checkusers will be granted access to the page, UNLESS
-     * that page is also set to DENY (note, not default) New/Declined/Suspended users. I have no problem with this
-     * method being used, but please ONLY use it in this class in static methods of Security. Nowhere else.
-     *
-     * @param string $checkuser
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setCheckuser($checkuser)
-    {
-        $this->checkuser = $checkuser;
-
-        return $this;
-    }
-
-    /**
-     * Returns if a user is required to be identified.
-     *
-     * @return boolean
-     */
-    public function requiresIdentifiedUser()
-    {
-        return $this->requireIdentified;
-    }
-
-    /**
-     * @return string
-     */
-    public function getAdmin()
-    {
-        return $this->admin;
-    }
-
-    /**
-     * @param string $admin
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setAdmin($admin)
-    {
-        $this->admin = $admin;
-
-        return $this;
-    }
-
-    /**
-     * @return string
-     */
-    public function getUser()
-    {
-        return $this->user;
-    }
-
-    /**
-     * @param string $user
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setUser($user)
-    {
-        $this->user = $user;
-
-        return $this;
-    }
-
-    /**
-     * @return string
-     */
-    public function getCheckuser()
-    {
-        return $this->checkuser;
-    }
-
-    /**
-     * @return string
-     */
-    public function getCommunity()
-    {
-        return $this->community;
-    }
-
-    /**
-     * @param string $community
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setCommunity($community)
-    {
-        $this->community = $community;
-
-        return $this;
-    }
-
-    /**
-     * @return string
-     */
-    public function getSuspended()
-    {
-        return $this->suspended;
-    }
-
-    /**
-     * @param string $suspended
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setSuspended($suspended)
-    {
-        $this->suspended = $suspended;
-
-        return $this;
-    }
-
-    /**
-     * @return string
-     */
-    public function getDeclined()
-    {
-        return $this->declined;
-    }
-
-    /**
-     * @param string $declined
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setDeclined($declined)
-    {
-        $this->declined = $declined;
-
-        return $this;
-    }
-
-    /**
-     * @return string
-     */
-    public function getNew()
-    {
-        return $this->new;
-    }
-
-    /**
-     * @param string $new
-     *
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function setNew($new)
-    {
-        $this->new = $new;
-
-        return $this;
-    }
-
-    /**
-     * @param boolean $requireIdentified
-     */
-    public function setRequireIdentified($requireIdentified)
-    {
-        $this->requireIdentified = $requireIdentified;
-    }
+	const ALLOW = "allow";
+	const DENY = "deny";
+	private $admin = "default";
+	private $user = "default";
+	private $checkuser = "default";
+	private $community = "default";
+	private $suspended = "default";
+	private $declined = "default";
+	private $new = "default";
+	private $requireIdentified;
+
+	/**
+	 * Sets whether a checkuser is able to gain access.
+	 *
+	 * This is private because it's DANGEROUS. Checkusers are not mutually-exclusive with other rights. As such, a
+	 * suspended checkuser who tries to access a page which allows checkusers will be granted access to the page, UNLESS
+	 * that page is also set to DENY (note, not default) New/Declined/Suspended users. I have no problem with this
+	 * method being used, but please ONLY use it in this class in static methods of Security. Nowhere else.
+	 *
+	 * @param string $checkuser
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setCheckuser($checkuser)
+	{
+		$this->checkuser = $checkuser;
+
+		return $this;
+	}
+
+	/**
+	 * Returns if a user is required to be identified.
+	 *
+	 * @return boolean
+	 */
+	public function requiresIdentifiedUser()
+	{
+		return $this->requireIdentified;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getAdmin()
+	{
+		return $this->admin;
+	}
+
+	/**
+	 * @param string $admin
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setAdmin($admin)
+	{
+		$this->admin = $admin;
+
+		return $this;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getUser()
+	{
+		return $this->user;
+	}
+
+	/**
+	 * @param string $user
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setUser($user)
+	{
+		$this->user = $user;
+
+		return $this;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getCheckuser()
+	{
+		return $this->checkuser;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getCommunity()
+	{
+		return $this->community;
+	}
+
+	/**
+	 * @param string $community
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setCommunity($community)
+	{
+		$this->community = $community;
+
+		return $this;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getSuspended()
+	{
+		return $this->suspended;
+	}
+
+	/**
+	 * @param string $suspended
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setSuspended($suspended)
+	{
+		$this->suspended = $suspended;
+
+		return $this;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getDeclined()
+	{
+		return $this->declined;
+	}
+
+	/**
+	 * @param string $declined
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setDeclined($declined)
+	{
+		$this->declined = $declined;
+
+		return $this;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getNew()
+	{
+		return $this->new;
+	}
+
+	/**
+	 * @param string $new
+	 *
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function setNew($new)
+	{
+		$this->new = $new;
+
+		return $this;
+	}
+
+	/**
+	 * @param boolean $requireIdentified
+	 */
+	public function setRequireIdentified($requireIdentified)
+	{
+		$this->requireIdentified = $requireIdentified;
+	}
 }
\ No newline at end of file

includes/Security/SecurityManager.php

Indentation +71 added lines, -71 removed lines

@@ -14,84 +14,84 @@
 
 final class SecurityManager
 {
-    /** @var IdentificationVerifier */
-    private $identificationVerifier;
-    /** @var SecurityConfigurationFactory */
-    private $securityConfigurationFactory;
+	/** @var IdentificationVerifier */
+	private $identificationVerifier;
+	/** @var SecurityConfigurationFactory */
+	private $securityConfigurationFactory;
 
-    /**
-     * SecurityManager constructor.
-     *
-     * @param IdentificationVerifier $identificationVerifier
-     * @param bool                   $forceIdentification
-     */
-    public function __construct(IdentificationVerifier $identificationVerifier, $forceIdentification)
-    {
-        $this->identificationVerifier = $identificationVerifier;
+	/**
+	 * SecurityManager constructor.
+	 *
+	 * @param IdentificationVerifier $identificationVerifier
+	 * @param bool                   $forceIdentification
+	 */
+	public function __construct(IdentificationVerifier $identificationVerifier, $forceIdentification)
+	{
+		$this->identificationVerifier = $identificationVerifier;
 
-        $this->securityConfigurationFactory = new SecurityConfigurationFactory($forceIdentification);
-    }
+		$this->securityConfigurationFactory = new SecurityConfigurationFactory($forceIdentification);
+	}
 
-    public function configure()
-    {
-        return $this->securityConfigurationFactory;
-    }
+	public function configure()
+	{
+		return $this->securityConfigurationFactory;
+	}
 
-    /**
-     * @param $value
-     * @param $filter
-     *
-     * @return bool
-     * @throws AccessDeniedException
-     * @category Security-Critical
-     */
-    private function test($value, $filter)
-    {
-        if (!$filter) {
-            return false;
-        }
+	/**
+	 * @param $value
+	 * @param $filter
+	 *
+	 * @return bool
+	 * @throws AccessDeniedException
+	 * @category Security-Critical
+	 */
+	private function test($value, $filter)
+	{
+		if (!$filter) {
+			return false;
+		}
 
-        if ($value == SecurityConfiguration::DENY) {
-            // FILE_NOT_FOUND...?
-            throw new AccessDeniedException();
-        }
+		if ($value == SecurityConfiguration::DENY) {
+			// FILE_NOT_FOUND...?
+			throw new AccessDeniedException();
+		}
 
-        return $value === SecurityConfiguration::ALLOW;
-    }
+		return $value === SecurityConfiguration::ALLOW;
+	}
 
-    /**
-     * Tests if a user is allowed to perform an action.
-     *
-     * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
-     * that a user should have access to something.
-     *
-     * @param SecurityConfiguration $config
-     * @param User                  $user
-     *
-     * @return bool
-     *
-     * @category Security-Critical
-     */
-    public function allows(SecurityConfiguration $config, User $user)
-    {
-        if ($config->requiresIdentifiedUser() && !$user->isCommunityUser() && !$user->isIdentified($this->identificationVerifier)) {
-            return false;
-        }
+	/**
+	 * Tests if a user is allowed to perform an action.
+	 *
+	 * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
+	 * that a user should have access to something.
+	 *
+	 * @param SecurityConfiguration $config
+	 * @param User                  $user
+	 *
+	 * @return bool
+	 *
+	 * @category Security-Critical
+	 */
+	public function allows(SecurityConfiguration $config, User $user)
+	{
+		if ($config->requiresIdentifiedUser() && !$user->isCommunityUser() && !$user->isIdentified($this->identificationVerifier)) {
+			return false;
+		}
 
-        try {
-            $allowed = $this->test($config->getAdmin(), $user->isAdmin())
-                || $this->test($config->getUser(), $user->isUser())
-                || $this->test($config->getCommunity(), $user->isCommunityUser())
-                || $this->test($config->getSuspended(), $user->isSuspended())
-                || $this->test($config->getDeclined(), $user->isDeclined())
-                || $this->test($config->getNew(), $user->isNewUser())
-                || $this->test($config->getCheckuser(), $user->isCheckuser());
+		try {
+			$allowed = $this->test($config->getAdmin(), $user->isAdmin())
+				|| $this->test($config->getUser(), $user->isUser())
+				|| $this->test($config->getCommunity(), $user->isCommunityUser())
+				|| $this->test($config->getSuspended(), $user->isSuspended())
+				|| $this->test($config->getDeclined(), $user->isDeclined())
+				|| $this->test($config->getNew(), $user->isNewUser())
+				|| $this->test($config->getCheckuser(), $user->isCheckuser());
 
-            return $allowed;
-        }
-        catch (AccessDeniedException $ex) {
-            // something is set to deny.
-            return false;
-        }
-    }
+			return $allowed;
+		}
+		catch (AccessDeniedException $ex) {
+			// something is set to deny.
+			return false;
+		}
+	}
 }
\ No newline at end of file

includes/Security/TokenManager.php

Indentation +87 added lines, -87 removed lines

@@ -13,91 +13,91 @@
 
 class TokenManager
 {
-    /**
-     * Validates a CSRF token
-     *
-     * @param string      $data    The token data string itself
-     * @param string|null $context Token context for extra validation
-     *
-     * @return bool
-     */
-    public function validateToken($data, $context = null)
-    {
-        if (!is_string($data) || strlen($data) === 0) {
-            // Nothing to validate
-            return false;
-        }
-
-        $tokens = WebRequest::getSessionTokenData();
-
-        // if the token doesn't exist, then it's not valid
-        if (!array_key_exists($data, $tokens)) {
-            return false;
-        }
-
-        /** @var Token $token */
-        $token = unserialize($tokens[$data]);
-
-        if ($token->getTokenData() !== $data) {
-            return false;
-        }
-
-        if ($token->getContext() !== $context) {
-            return false;
-        }
-
-        if ($token->isUsed()) {
-            return false;
-        }
-
-        // mark the token as used, and save it back to the session
-        $token->markAsUsed();
-        $this->storeToken($token);
-
-        return true;
-    }
-
-    /**
-     * @param string|null $context An optional context for extra validation
-     *
-     * @return Token
-     */
-    public function getNewToken($context = null)
-    {
-        $token = new Token($this->generateTokenData(), $context);
-        $this->storeToken($token);
-
-        return $token;
-    }
-
-    /**
-     * Stores a token in the session data
-     *
-     * @param Token $token
-     */
-    private function storeToken(Token $token)
-    {
-        $tokens = WebRequest::getSessionTokenData();
-        $tokens[$token->getTokenData()] = serialize($token);
-        WebRequest::setSessionTokenData($tokens);
-    }
-
-    /**
-     * Generates a security token
-     *
-     * @return string
-     * @throws Exception
-     *
-     * @category Security-Critical
-     */
-    private function generateTokenData()
-    {
-        $genBytes = openssl_random_pseudo_bytes(33);
-
-        if ($genBytes !== false) {
-            return base64_encode($genBytes);
-        }
-
-        throw new Exception('Unable to generate secure token.');
-    }
+	/**
+	 * Validates a CSRF token
+	 *
+	 * @param string      $data    The token data string itself
+	 * @param string|null $context Token context for extra validation
+	 *
+	 * @return bool
+	 */
+	public function validateToken($data, $context = null)
+	{
+		if (!is_string($data) || strlen($data) === 0) {
+			// Nothing to validate
+			return false;
+		}
+
+		$tokens = WebRequest::getSessionTokenData();
+
+		// if the token doesn't exist, then it's not valid
+		if (!array_key_exists($data, $tokens)) {
+			return false;
+		}
+
+		/** @var Token $token */
+		$token = unserialize($tokens[$data]);
+
+		if ($token->getTokenData() !== $data) {
+			return false;
+		}
+
+		if ($token->getContext() !== $context) {
+			return false;
+		}
+
+		if ($token->isUsed()) {
+			return false;
+		}
+
+		// mark the token as used, and save it back to the session
+		$token->markAsUsed();
+		$this->storeToken($token);
+
+		return true;
+	}
+
+	/**
+	 * @param string|null $context An optional context for extra validation
+	 *
+	 * @return Token
+	 */
+	public function getNewToken($context = null)
+	{
+		$token = new Token($this->generateTokenData(), $context);
+		$this->storeToken($token);
+
+		return $token;
+	}
+
+	/**
+	 * Stores a token in the session data
+	 *
+	 * @param Token $token
+	 */
+	private function storeToken(Token $token)
+	{
+		$tokens = WebRequest::getSessionTokenData();
+		$tokens[$token->getTokenData()] = serialize($token);
+		WebRequest::setSessionTokenData($tokens);
+	}
+
+	/**
+	 * Generates a security token
+	 *
+	 * @return string
+	 * @throws Exception
+	 *
+	 * @category Security-Critical
+	 */
+	private function generateTokenData()
+	{
+		$genBytes = openssl_random_pseudo_bytes(33);
+
+		if ($genBytes !== false) {
+			return base64_encode($genBytes);
+		}
+
+		throw new Exception('Unable to generate secure token.');
+	}
 }
\ No newline at end of file

includes/Security/SecurityConfigurationFactory.php

Indentation +148 added lines, -148 removed lines

@@ -10,152 +10,152 @@
 
 final class SecurityConfigurationFactory
 {
-    /**
-     * @var bool
-     */
-    private $forceIdentified;
-
-    /**
-     * Security constructor.
-     *
-     * @param bool $forceIdentified
-     */
-    public function __construct($forceIdentified)
-    {
-        $this->forceIdentified = $forceIdentified;
-    }
-
-    /**
-     * Returns a pre-built security configuration for an internal page.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asInternalPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW)
-            ->setUser(SecurityConfiguration::ALLOW);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * Returns a pre-built security configuration for a tool admin only page.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asAdminPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * Returns a pre-built security configuration for a page accessible to *ALL* logged in users, including suspended
-     * and new users. This probably isn't the setting you want.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asAllLoggedInUsersPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW)
-            ->setUser(SecurityConfiguration::ALLOW)
-            ->setDeclined(SecurityConfiguration::ALLOW)
-            ->setNew(SecurityConfiguration::ALLOW)
-            ->setSuspended(SecurityConfiguration::ALLOW);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function asCheckUserData()
-    {
-        $config = new SecurityConfiguration();
-        $config->setCheckuser(SecurityConfiguration::ALLOW)
-            ->setCommunity(SecurityConfiguration::DENY)
-            ->setSuspended(SecurityConfiguration::DENY)
-            ->setDeclined(SecurityConfiguration::DENY)
-            ->setNew(SecurityConfiguration::DENY);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * Returns a pre-built security configuration for a public page.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asPublicPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW)
-            ->setUser(SecurityConfiguration::ALLOW)
-            ->setCheckuser(SecurityConfiguration::ALLOW)
-            ->setCommunity(SecurityConfiguration::ALLOW)
-            ->setSuspended(SecurityConfiguration::ALLOW)
-            ->setDeclined(SecurityConfiguration::ALLOW)
-            ->setNew(SecurityConfiguration::ALLOW);
-
-        // Public pages shouldn't be inaccessible to logged-in, unidentified users.
-        // Otherwise, logged in but unidentified users can't even log out.
-        $config->setRequireIdentified(false);
-
-        return $config;
-    }
-
-    /**
-     * Special case for zoom page private data.
-     *
-     * This will only return true if you are either a checkuser or a tool admin, taking special note of disabled
-     * accounts which happen to be check users
-     *
-     * @return SecurityConfiguration
-     */
-    public function asGeneralPrivateDataAccess()
-    {
-        $config = new SecurityConfiguration();
-        $config
-            // Basic configuration, admins and check users allowed
-            ->setAdmin(SecurityConfiguration::ALLOW)
-            ->setCheckuser(SecurityConfiguration::ALLOW)
-            // Deny these, even if they were allowed by the above
-            ->setCommunity(SecurityConfiguration::DENY)
-            ->setSuspended(SecurityConfiguration::DENY)
-            ->setDeclined(SecurityConfiguration::DENY)
-            ->setNew(SecurityConfiguration::DENY);
-
-        // You must also be identified to access this data
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asNone()
-    {
-        $config = new SecurityConfiguration();
-
-        return $config;
-    }
+	/**
+	 * @var bool
+	 */
+	private $forceIdentified;
+
+	/**
+	 * Security constructor.
+	 *
+	 * @param bool $forceIdentified
+	 */
+	public function __construct($forceIdentified)
+	{
+		$this->forceIdentified = $forceIdentified;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for an internal page.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asInternalPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW)
+			->setUser(SecurityConfiguration::ALLOW);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for a tool admin only page.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asAdminPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for a page accessible to *ALL* logged in users, including suspended
+	 * and new users. This probably isn't the setting you want.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asAllLoggedInUsersPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW)
+			->setUser(SecurityConfiguration::ALLOW)
+			->setDeclined(SecurityConfiguration::ALLOW)
+			->setNew(SecurityConfiguration::ALLOW)
+			->setSuspended(SecurityConfiguration::ALLOW);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function asCheckUserData()
+	{
+		$config = new SecurityConfiguration();
+		$config->setCheckuser(SecurityConfiguration::ALLOW)
+			->setCommunity(SecurityConfiguration::DENY)
+			->setSuspended(SecurityConfiguration::DENY)
+			->setDeclined(SecurityConfiguration::DENY)
+			->setNew(SecurityConfiguration::DENY);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for a public page.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asPublicPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW)
+			->setUser(SecurityConfiguration::ALLOW)
+			->setCheckuser(SecurityConfiguration::ALLOW)
+			->setCommunity(SecurityConfiguration::ALLOW)
+			->setSuspended(SecurityConfiguration::ALLOW)
+			->setDeclined(SecurityConfiguration::ALLOW)
+			->setNew(SecurityConfiguration::ALLOW);
+
+		// Public pages shouldn't be inaccessible to logged-in, unidentified users.
+		// Otherwise, logged in but unidentified users can't even log out.
+		$config->setRequireIdentified(false);
+
+		return $config;
+	}
+
+	/**
+	 * Special case for zoom page private data.
+	 *
+	 * This will only return true if you are either a checkuser or a tool admin, taking special note of disabled
+	 * accounts which happen to be check users
+	 *
+	 * @return SecurityConfiguration
+	 */
+	public function asGeneralPrivateDataAccess()
+	{
+		$config = new SecurityConfiguration();
+		$config
+			// Basic configuration, admins and check users allowed
+			->setAdmin(SecurityConfiguration::ALLOW)
+			->setCheckuser(SecurityConfiguration::ALLOW)
+			// Deny these, even if they were allowed by the above
+			->setCommunity(SecurityConfiguration::DENY)
+			->setSuspended(SecurityConfiguration::DENY)
+			->setDeclined(SecurityConfiguration::DENY)
+			->setNew(SecurityConfiguration::DENY);
+
+		// You must also be identified to access this data
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asNone()
+	{
+		$config = new SecurityConfiguration();
+
+		return $config;
+	}
 }
\ No newline at end of file

includes/Router/ApiRequestRouter.php

Indentation +36 added lines, -36 removed lines

@@ -20,43 +20,43 @@
 
 class ApiRequestRouter implements IRequestRouter
 {
-    /**
-     * @return string[]
-     */
-    public static function getActionList()
-    {
-        return array("count", "status", "stats", "help", "monitor");
-    }
+	/**
+	 * @return string[]
+	 */
+	public static function getActionList()
+	{
+		return array("count", "status", "stats", "help", "monitor");
+	}
 
-    /**
-     * @return IRoutedTask
-     * @throws Exception
-     */
-    public function route()
-    {
-        $requestAction = WebRequest::getString('action');
+	/**
+	 * @return IRoutedTask
+	 * @throws Exception
+	 */
+	public function route()
+	{
+		$requestAction = WebRequest::getString('action');
 
-        switch ($requestAction) {
-            case "count":
-                $result = new CountAction();
-                break;
-            case "status":
-                $result = new StatusAction();
-                break;
-            case "stats":
-                $result = new StatsAction();
-                break;
-            case "help":
-                $result = new HelpAction();
-                break;
-            case "monitor":
-                $result = new MonitorAction();
-                break;
-            default:
-                $result = new UnknownAction();
-                break;
-        }
+		switch ($requestAction) {
+			case "count":
+				$result = new CountAction();
+				break;
+			case "status":
+				$result = new StatusAction();
+				break;
+			case "stats":
+				$result = new StatsAction();
+				break;
+			case "help":
+				$result = new HelpAction();
+				break;
+			case "monitor":
+				$result = new MonitorAction();
+				break;
+			default:
+				$result = new UnknownAction();
+				break;
+		}
 
-        return $result;
-    }
+		return $result;
+	}
 }
\ No newline at end of file

includes/Router/OAuthRequestRouter.php

Indentation +5 added lines, -5 removed lines

@@ -17,9 +17,9 @@
  */
 class OAuthRequestRouter extends RequestRouter
 {
-    protected function getRouteFromPath($pathInfo)
-    {
-        // Hardcode the route for this entry point
-        return array(PageOAuth::class, 'callback');
-    }
+	protected function getRouteFromPath($pathInfo)
+	{
+		// Hardcode the route for this entry point
+		return array(PageOAuth::class, 'callback');
+	}
 }
\ No newline at end of file

includes/Router/IRequestRouter.php

Indentation +5 added lines, -5 removed lines

@@ -18,9 +18,9 @@
  */
 interface IRequestRouter
 {
-    /**
-     * @return IRoutedTask
-     * @throws Exception
-     */
-    public function route();
+	/**
+	 * @return IRoutedTask
+	 * @throws Exception
+	 */
+	public function route();
 }
\ No newline at end of file