From b7fd908d538ed19fe41f03c0a3f93351d8da64e9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 14 Apr 2024 15:15:40 +0200
Subject: Adding upstream version 2.5.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 library/Businessprocess/Web/Form/CsrfToken.php | 53 ++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 library/Businessprocess/Web/Form/CsrfToken.php

(limited to 'library/Businessprocess/Web/Form/CsrfToken.php')

diff --git a/library/Businessprocess/Web/Form/CsrfToken.php b/library/Businessprocess/Web/Form/CsrfToken.php
new file mode 100644
index 0000000..9eb24ef
--- /dev/null
+++ b/library/Businessprocess/Web/Form/CsrfToken.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace Icinga\Module\Businessprocess\Web\Form;
+
+class CsrfToken
+{
+    /**
+     * Check whether the given token is valid
+     *
+     * @param string $token Token
+     *
+     * @return bool
+     */
+    public static function isValid($token)
+    {
+        if (strpos($token, '|') === false) {
+            return false;
+        }
+
+        list($seed, $token) = explode('|', $token);
+
+        if (!is_numeric($seed)) {
+            return false;
+        }
+
+        return $token === hash('sha256', self::getSessionId() . $seed);
+    }
+
+    /**
+     * Create a new token
+     *
+     * @return string
+     */
+    public static function generate()
+    {
+        $seed = mt_rand();
+        $token = hash('sha256', self::getSessionId() . $seed);
+
+        return sprintf('%s|%s', $seed, $token);
+    }
+
+    /**
+     * Get current session id
+     *
+     * TODO: we should do this through our App or Session object
+     *
+     * @return string
+     */
+    protected static function getSessionId()
+    {
+        return session_id();
+    }
+}
-- 
cgit v1.2.3