AbstractConfirmationToken::checkToken() - Code Metrics - Inspection of "Implement ConfirmationTokenChain to handle multipl..." - silverstripe/silverstripe-framework - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — 4.1 ( 6d2665...02ad0f )

unknown

created 2018-11-06 22:33 UTC

AbstractConfirmationToken::checkToken() A

↳ Parent: AbstractConfirmationToken

Complexity

Conditions	3
Paths	3

Size

Total Lines	15
Code Lines	8

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	3
eloc	8
nc	3
nop	1
dl	0
loc	15
rs	10
c	0
b	0
f	0

<?php

namespace SilverStripe\Core\Startup;

use SilverStripe\Control\Controller;
use SilverStripe\Control\Director;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Control\HTTPResponse;
use SilverStripe\Core\Convert;
use SilverStripe\Security\RandomGenerator;

/**
 * Shared functionality for token-based authentication of potentially dangerous URLs or query
 * string parameters
 *
 * @internal This class is designed specifically for use pre-startup and may change without warning
 */
abstract class AbstractConfirmationToken
{
    /**
     * @var HTTPRequest
     */
    protected $request = null;

    /**
     * The validated and checked token for this parameter
     *
     * @var string|null A string value, or null if either not provided or invalid
     */
    protected $token = null;

    /**
     * Given a list of token names, suppress all tokens that have not been validated, and
     * return the non-validated token with the highest priority
     *
     * @param array $keys List of token keys in ascending priority (low to high)
     * @param HTTPRequest $request
     * @return static The token container for the unvalidated $key given with the highest priority
     */
    public static function prepare_tokens($keys, HTTPRequest $request)
    {
        $target = null;
        foreach ($keys as $key) {
            $token = new static($key, $request);
            $token = /** @scrutinizer ignore-call */ new static($key, $request);
            // Validate this token
            if ($token->reloadRequired() || $token->reloadRequiredIfError()) {
                $token->suppress();
                $target = $token;
            }
        }
        return $target;
    }

    /**
     * Generate a local filesystem path to store a token
     *
     * @param $token
     * @return string
     */
    protected function pathForToken($token)
    {
        return TEMP_PATH . DIRECTORY_SEPARATOR . 'token_' . preg_replace('/[^a-z0-9]+/', '', $token);
    }

    /**
     * Generate a new random token and store it
     *
     * @return string Token name
     */
    protected function genToken()
    {
        // Generate a new random token (as random as possible)
        $rg = new RandomGenerator();
        $token = $rg->randomToken('md5');

        // Store a file in the session save path (safer than /tmp, as open_basedir might limit that)
        file_put_contents($this->pathForToken($token), $token);

        return $token;
    }

    /**
     * Is the necessary token provided for this parameter?
     * A value must be provided for the token
     *
     * @return bool
     */
    public function tokenProvided()
    {
        return !empty($this->token);
    }

    /**
     * Validate a token
     *
     * @param string $token
     * @return boolean True if the token is valid
     */
    protected function checkToken($token)
    {
        if (!$token) {
            return false;
        }

        $file = $this->pathForToken($token);
        $content = null;

        if (file_exists($file)) {
            $content = file_get_contents($file);
            unlink($file);
        }

        return $content === $token;
    }

    /**
     * Get redirect url, excluding querystring
     *
     * @return string
     */
    public function currentURL()
    {
        return Controller::join_links(Director::baseURL(), $this->request->getURL(false));
    }

    /**
     * Forces a reload of the request with the token included
     *
     * @return HTTPResponse
     */
    public function reloadWithToken()
    {
        $location = $this->redirectURL();
        $locationJS = Convert::raw2js($location);
        $locationATT = Convert::raw2att($location);
        $body = <<<HTML
<script>location.href='$locationJS';</script>
<noscript><meta http-equiv="refresh" content="0; url=$locationATT"></noscript>
You are being redirected. If you are not redirected soon, <a href="$locationATT">click here to continue</a>
HTML;

        // Build response
        $result = new HTTPResponse($body);
        $result->redirect($location);
        return $result;
    }

    /**
     * Is this parameter requested without a valid token?
     *
     * @return bool True if the parameter is given without a valid token
     */
    abstract public function reloadRequired();

    /**
     * Check if this token is provided either in the backurl, or directly,
     * but without a token
     *
     * @return bool
     */
    abstract public function reloadRequiredIfError();

    /**
     * Suppress the current parameter for the duration of this request
     */
    abstract public function suppress();

    /**
     * Determine the querystring parameters to include
     *
     * @param bool $includeToken Include the token value?
     * @return array List of querystring parameters, possibly including token parameter
     */
    abstract public function params($includeToken = true);

    /**
     * @return string
     */
    abstract public function getRedirectUrlBase();

    /**
     * @return array
     */
    abstract public function getRedirectUrlParams();

    /**
     * Get redirection URL
     *
     * @return string
     */
    abstract protected function redirectURL();
}


silverstripe / silverstripe-framework

Push — 4.1 ( 6d2665...02ad0f )

AbstractConfirmationToken::checkToken() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like