/**
* Check a security token.
* Checks the POST and GET data for a security token, if one exists, validates
* that it's for this user and URL. If the token is not valid, it asks the user
* to re-authenticate and resends the request if authentication was successful.
*
* @return boolean true if the token is valid; does not return if not!
* @see SECINT_checkToken
* @link http://wiki.geeklog.net/index.php/Re-Authentication_for_expired_Tokens
*/
function SEC_checkToken()
{
global $_CONF, $LANG20, $LANG_ADMIN;
if (SECINT_checkToken()) {
// if this was a recreated request, recreate $_FILES array, too
SECINT_recreateFilesArray();
return true;
}
/**
* Token not valid (probably expired): Ask user to authenticate again
*/
$returnurl = COM_getCurrentUrl();
$method = strtoupper($_SERVER['REQUEST_METHOD']);
$postdata = serialize($_POST);
$getdata = serialize($_GET);
$files = '';
if (!empty($_FILES)) {
// rescue uploaded files
foreach ($_FILES as $key => $f) {
if (!empty($f['name'])) {
$filename = basename($f['tmp_name']);
move_uploaded_file($f['tmp_name'], $_CONF['path_data'] . $filename);
$_FILES[$key]['tmp_name'] = $filename;
// drop temp. dir
}
}
$files = serialize($_FILES);
}
$display = COM_showMessageText($LANG_ADMIN['token_expired']) . SECINT_authform($returnurl, $method, $postdata, $getdata, $files);
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG20[1]));
COM_output($display);
exit;
// we don't return from here
}
}
$postdata = '';
if (isset($_POST['token_postdata'])) {
$postdata = urldecode($_POST['token_postdata']);
}
$getdata = '';
if (isset($_POST['token_getdata'])) {
$getdata = urldecode($_POST['token_getdata']);
}
$files = '';
if (isset($_POST['token_files'])) {
$files = urldecode($_POST['token_files']);
}
if (SECINT_checkToken() && !empty($method) && !empty($returnurl) && ($method === 'POST' && !empty($postdata) || $method === 'GET' && !empty($getdata))) {
$display .= COM_showMessage(81);
$display .= SECINT_authform($returnurl, $method, $postdata, $getdata, $files);
} else {
if (!empty($files)) {
SECINT_cleanupFiles($files);
}
COM_redirect($_CONF['site_url'] . '/index.php');
}
}
break;
default:
// check to see if this was the last allowed attempt
if (COM_checkSpeedlimit('login', $_CONF['login_attempts']) > 0) {
displayLoginErrorAndAbort(82, $LANG04[113], $LANG04[112]);
} else {
// Show login form
if ($msg != 69 && $msg != 70) {
