public function eventPreSaveFilter(array $context)
{
if (!in_array('xss-fail', $context['event']->eParamFILTERS) && !in_array('validate-xsrf', $context['event']->eParamFILTERS)) {
return;
}
$contains_xss = FALSE;
// Loop over the fields to check for XSS, this loop will
// break as soon as XSS is detected
foreach ($context['fields'] as $field => $value) {
if (is_array($value)) {
if (self::detectXSSInArray($value) === FALSE) {
continue;
}
$contains_xss = TRUE;
break;
} else {
if (self::detectXSS($value) === FALSE) {
continue;
}
$contains_xss = TRUE;
break;
}
}
// Detect XSS filter
if (in_array('xss-fail', $context['event']->eParamFILTERS) && $contains_xss === TRUE) {
$context['messages'][] = array('xss', FALSE, __("Possible XSS attack detected in submitted data"));
}
// Validate XSRF token filter
if (in_array('validate-xsrf', $context['event']->eParamFILTERS)) {
if (Symphony::Engine()->isXSRFEnabled() && is_session_empty() === false && XSRF::validateRequest(true) === false) {
$context['messages'][] = array('xsrf', FALSE, __("Request was rejected for having an invalid cross-site request forgery token."));
}
}
}
/**
* Cleans up Session Cookies. When there is no data in the session the cookie will be unset.
* If there is data, the cookie will be renewed, expiring it in two weeks from now.
* This will improve the interoperability with caches like Varnish and Squid.
*
* @since 2.3.3
* @author creativedutchmen (Huib Keemink)
* @return void
*/
function cleanup_session_cookies()
{
/*
Unfortunately there is no way to delete a specific previously set cookie from PHP.
The only way seems to be the method employed here: store all the cookie we need to keep, then delete every cookie and add the stored cookies again.
Luckily we can just store the raw header and output them again, so we do not need to actively parse the header string.
*/
$cookie_params = session_get_cookie_params();
$list = headers_list();
$custom_cookies = array();
foreach ($list as $hdr) {
if (stripos($hdr, 'Set-Cookie') !== false && stripos($hdr, session_id()) === false) {
$custom_cookies[] = $hdr;
}
}
header_remove('Set-Cookie');
foreach ($custom_cookies as $custom_cookie) {
header($custom_cookie);
}
$session_is_empty = is_session_empty();
if ($session_is_empty && !empty($_COOKIE[session_name()])) {
setcookie(session_name(), session_id(), time() - 3600, $cookie_params['path'], $cookie_params['domain'], $cookie_params['secure'], $cookie_params['httponly']);
} elseif (!$session_is_empty) {
setcookie(session_name(), session_id(), time() + TWO_WEEKS, $cookie_params['path'], $cookie_params['domain'], $cookie_params['secure'], $cookie_params['httponly']);
}
}
