public function make_response($response)
{
require_once APP_DIR . "plugins/csrf.php";
$csrf_obj = new csrf();
$csrf_obj->clear_values();
$token_id = $csrf_obj->get_token_id();
$token = $csrf_obj->get_token();
$response["token_id"] = $token_id;
$response["token"] = $token;
echo json_encode($response);
}
/**
* Show shouts or shout
*/
public function index()
{
$shout = new Shout_Model();
$form_values = $shout->as_array();
$form_errors = array();
// Check post
if (csrf::valid() && ($post = $this->input->post())) {
$shout->author_id = $this->user->id;
$shout->shout = $post['shout'];
try {
$shout->save();
if (!request::is_ajax()) {
url::redirect(url::current());
}
} catch (ORM_Validation_Exception $e) {
$form_errors = $e->validation->errors();
$form_values = arr::overwrite($form_values, $post);
}
}
$shouts = ORM::factory('shout')->find_all(10);
$view = View_Mod::factory('generic/shout', array('mod_title' => __('Shouts'), 'shouts' => $shouts, 'can_shout' => ORM::factory('shout')->has_access(Shout_Model::ACCESS_WRITE, $this->user), 'errors' => $form_errors, 'values' => $form_values));
if (request::is_ajax()) {
echo $view;
return;
}
widget::add('main', $view);
}
/**
* Generates an opening HTML form tag.
*
* @param string form action attribute
* @param array extra attributes
* @param array hidden fields to be created immediately after the form tag
* @return string
*/
public static function open($action = NULL, $attr = array(), $hidden = NULL)
{
// Make sure that the method is always set
empty($attr['method']) and $attr['method'] = 'post';
if ($attr['method'] !== 'post' and $attr['method'] !== 'get') {
// If the method is invalid, use post
$attr['method'] = 'post';
}
if ($action === NULL) {
// Use the current URL as the default action
$action = url::site(Router::$complete_uri);
} elseif (strpos($action, '://') === FALSE) {
// Make the action URI into a URL
$action = url::site($action);
}
// Set action
$attr['action'] = $action;
// Only show the CSRF field when form method is POST
$hidden_field = $attr['method'] === 'post' ? form::hidden('form_auth_token', csrf::token()) . "\n" : '';
// Form opening tag
$form = '<form' . form::attributes($attr) . '>' . "\n" . $hidden_field;
// Add hidden fields immediate after opening tag
empty($hidden) or $form .= form::hidden($hidden);
return $form;
}
public static function login($_login, $_password)
{
// retrieve hash for `$_login` user with SQL query
$user = DB::Prepare("SELECT `id`, `login`, `password`, `email` FROM users WHERE `login` = :login;", array('login' => $_login));
if (!is_array($user)) {
return false;
}
$hash = $user['password'];
if (self::check_password($hash, $_password)) {
// store session
$_SESSION = array();
$_SESSION['logged'] = true;
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
$_SESSION['token'] = csrf::generate_token();
// remove password from $user
unset($user['password']);
$_SESSION['user'] = $user;
return true;
}
return false;
}
// AFFERO GENERAL PUBLIC LICENSE is also included in the file called "COPYING".
include_once 'Smarty.class.php';
$main_smarty = new Smarty();
include 'config.php';
include mnminclude . 'html1.php';
include mnminclude . 'link.php';
include mnminclude . 'group.php';
include mnminclude . 'user.php';
include mnminclude . 'friend.php';
include mnminclude . 'smartyvariables.php';
include mnminclude . 'csrf.php';
$offset = (get_current_page() - 1) * $page_size;
$main_smarty = do_sidebar($main_smarty);
define('pagename', 'user');
$main_smarty->assign('pagename', pagename);
$CSRF = new csrf();
$CSRF->create('user_settings', true, true);
// if not logged in, redirect to the index page
$login = isset($_GET['login']) ? sanitize($_GET['login'], 3) : '';
$truelogin = isset($_COOKIE['mnm_user']) ? sanitize($_COOKIE['mnm_user'], 3) : '';
if ($login === '') {
if ($current_user->user_id > 0) {
$login = $current_user->user_login;
} else {
header('Location: ' . $my_base_url . $my_pligg_base);
die;
}
}
// setup the breadcrumbs
$navwhere['text1'] = $main_smarty->get_config_vars('PLIGG_Visual_Breadcrumb_Profile');
$navwhere['link1'] = getmyurl('topusers');
/**
* Template loading and setup routine.
*/
public function __construct()
{
parent::__construct();
// Get loaded modules
$this->modules = Kohana_Config::instance()->get('core.modules');
// Initialize libraries
$this->cache = Cache::instance();
$this->input = Input::instance();
$this->uri = URI::instance();
$this->visitor = Visitor::instance();
// Validate CSRF token
if (isset($_REQUEST['csrf'])) {
$this->valid_csrf = csrf::valid($_REQUEST['csrf']);
}
// Load current user for easy controller access, null if not logged
$this->user =& $this->visitor->get_user();
// Build the page
$this->template = View::factory($this->template);
// Display the template immediately after the controller method?
if ($this->auto_render === true) {
Event::add('system.post_controller', array($this, '_display'));
}
}
/**
* Creates a csrf token form input.
*
* @access public
* @return string
*/
public static function token()
{
return Form::input('token', csrf::token(), array('type' => 'hidden'));
}
<?php
/**
* This code is part of the Tutsplus course PHP Security Pitfalls.
* It is meant for demonstration purposes only.
* Do not use this code in a production environment!
*/
require 'functions.php';
// Check token
require 'csrf.php';
$csrf = new csrf();
if ($csrf->check_token($csrf->get_token_from_url()) == FALSE) {
die('You cannot login');
}
$_SESSION['loggedin'] = TRUE;
header('location: index.php');
<?php
define('IN_GB', TRUE);
session_start();
include "includes/gb.class.php";
include "includes/config.php";
include "language/{$default_language}";
include "includes/rain.tpl.class.php";
include "includes/csrf.class.php";
raintpl::configure("base_url", null);
raintpl::configure("tpl_dir", "themes/{$theme}/");
raintpl::configure("cache_dir", "cache/");
// Generate Token Id and Valid
$csrf = new csrf();
$token_id = $csrf->get_token_id();
$token_value = $csrf->get_token($token_id);
//initialize a Rain TPL object
$tpl = new RainTPL();
$tpl->assign("theme", $theme);
$tpl->assign("title", $title);
$tpl->assign("headingtitletxt", $headingtitletxt);
$tpl->assign("addentrytxt", $addentrytxt);
$tpl->assign("viewguestbooktxt", $viewguestbooktxt);
$tpl->assign("newpostfirsttxt", $newpostfirsttxt);
$tpl->assign("newpostlasttxt", $newpostlasttxt);
$tpl->assign("searchlabeltxt", $searchlabeltxt);
$tpl->assign("searchbuttontxt", $searchbuttontxt);
$tpl->assign("yournametxt", $yournametxt);
$tpl->assign("youremailtxt", $youremailtxt);
$tpl->assign("yourMessagetxt", $yourMessagetxt);
$tpl->assign("yourCountrytxt", $yourCountrytxt);
/**
* Edit entry
*
* @param integer|string $entry_id
*/
public function _entry_edit($entry_id = false)
{
$this->history = false;
$entry = new Blog_Entry_Model((int) $entry_id);
// For authenticated users only
if (!$this->user || !$entry->is_author() && !$this->visitor->logged_in('admin')) {
url::redirect(empty($_SESSION['history']) ? '/blogs' : $_SESSION['history']);
}
$errors = $form_errors = array();
$form_messages = '';
$form_values = $entry->as_array();
/***** CHECK POST *****/
if (request::method() == 'post') {
$post = $this->input->post();
// update
$editing = (bool) $entry->id;
if ($editing) {
$extra['modified'] = date::unix2sql(time());
$extra['modifies'] = (int) $entry->modifies + 1;
} else {
$extra['author_id'] = $this->user->id;
}
if ($entry->validate($post, true, $extra)) {
// News feed event
if (!$editing) {
newsfeeditem_blog::entry($this->user, $entry);
}
url::redirect(url::model($entry));
} else {
$form_errors = $post->errors();
$form_messages = $post->message();
}
$form_values = arr::overwrite($form_values, $post->as_array());
}
/***** /CHECK POST *****/
/***** SHOW FORM *****/
if ($entry->id) {
$this->page_actions[] = array('link' => url::model($entry) . '/delete?token=' . csrf::token($this->user->id), 'text' => __('Delete entry'), 'class' => 'entry-delete');
$this->page_title = text::title($entry->name);
$this->page_subtitle = __('Edit entry');
} else {
$this->page_title = __('New entry');
}
$form = $entry->get_form();
if (empty($errors)) {
widget::add('head', html::script(array('js/jquery.markitup.pack.js', 'js/markitup.bbcode.js')));
widget::add('main', View::factory('blog/entry_edit', array('form' => $form, 'values' => $form_values, 'errors' => $form_errors, 'messages' => $form_messages)));
} else {
$this->_error(Kohana::lang('generic.error'), $errors);
}
/***** /SHOW FORM *****/
}
<?php
include_once 'internal/Smarty.class.php';
$main_smarty = new Smarty();
include 'config.php';
include mnminclude . 'html1.php';
include mnminclude . 'link.php';
include mnminclude . 'tags.php';
include mnminclude . 'user.php';
include mnminclude . 'csrf.php';
include mnminclude . 'smartyvariables.php';
#ini_set('display_errors', 1);
error_reporting(E_ALL ^ E_NOTICE);
check_referrer();
// sessions used to prevent CSRF
$CSRF = new csrf();
// sidebar
$main_smarty = do_sidebar($main_smarty);
$canIhaveAccess = $_GET['login'] == $current_user->user_login;
$canIhaveAccess = $canIhaveAccess + checklevel('admin');
$canIhaveAccess = $canIhaveAccess + checklevel('moderator');
// If not logged in, redirect to the index page
if ($_GET['login'] && $canIhaveAccess) {
$login = $_GET['login'];
} elseif ($current_user->user_id > 0 && $current_user->authenticated) {
$login = $current_user->user_login;
if ($_GET['avatar'] != 'edit') {
header("Location: {$my_base_url}{$my_pligg_base}/user/{$login}/edit/");
}
} else {
//header('Location: '.$my_base_url.$my_pligg_base);
if (isset($_REQUEST['title'])) {
$requestTitle = $db->escape(strip_tags($_REQUEST['title']));
}
//check group admin
$canIhaveAccess = checklevel('god');
if ($current_user->user_id != get_group_creator($requestID) && $canIhaveAccess != 1) {
//page redirect
$redirect = '';
$redirect = getmyurl("group_story", $requestID);
// header("Location: $redirect");
die;
}
// pagename
define('pagename', 'editgroup');
$main_smarty->assign('pagename', pagename);
$CSRF = new csrf();
// uploading avatar
if ($_POST["avatar"] == "uploaded") {
$CSRF->check_expired('edit_group');
if ($CSRF->check_valid(sanitize($_POST['token'], 3), 'edit_group')) {
$user_image_path = "avatars/groups_uploaded" . "/";
$user_image_apath = "/" . $user_image_path;
$allowedFileTypes = array("image/jpeg", "image/gif", "image/png", 'image/x-png', 'image/pjpeg');
unset($imagename);
$myfile = $_FILES['image_file']['name'];
$imagename = basename($myfile);
$mytmpfile = $_FILES['image_file']['tmp_name'];
if (!in_array($_FILES['image_file']['type'], $allowedFileTypes)) {
$error['Type'] = 'Only these file types are allowed : jpeg, gif, png';
}
if (empty($error)) {
header("Location: " . getmyurl('admin_login', $_SERVER['REQUEST_URI']));
die;
}
if (caching == 1) {
// this is to clear the cache and reload it for settings_from_db.php
clearCatCache();
}
// breadcrumbs and page title
$navwhere['text1'] = $main_smarty->get_config_vars('PLIGG_Visual_Header_AdminPanel');
$navwhere['link1'] = getmyurl('admin', '');
$navwhere['text2'] = $main_smarty->get_config_vars('PLIGG_Visual_Header_AdminPanel_2');
$navwhere['link2'] = my_pligg_base . "/admin_categories.php";
$main_smarty->assign('navbar_where', $navwhere);
$main_smarty->assign('posttitle', " / " . $main_smarty->get_config_vars('PLIGG_Visual_Header_AdminPanel'));
if ($canIhaveAccess == 1) {
$CSRF = new csrf();
// clear the category sidebar module from the cache so it can regenerate in case we make changes
$main_smarty->cache = 2;
$main_smarty->cache_dir = "cache";
$main_smarty->clear_cache();
$main_smarty->cache = false;
$main_smarty = do_sidebar($main_smarty);
$smarty = $main_smarty;
$main_smarty = $smarty;
// pagename
define('pagename', 'admin_categories');
$main_smarty->assign('pagename', pagename);
// read the mysql database to get the pligg version
$sql = "SELECT data FROM " . table_misc_data . " WHERE name = 'pligg_version'";
$pligg_version = $db->get_var($sql);
$main_smarty->assign('version_number', $pligg_version);
// The source code packaged with this file is Free Software, Copyright (C) 2005 by
// Ricardo Galli <gallir at uib dot es>.
// It's licensed under the AFFERO GENERAL PUBLIC LICENSE unless stated otherwise.
// You can get copies of the licenses here:
// http://www.affero.org/oagpl.html
// AFFERO GENERAL PUBLIC LICENSE is also included in the file called "COPYING".
include_once 'Smarty.class.php';
$main_smarty = new Smarty();
include 'config.php';
include mnminclude . 'html1.php';
include mnminclude . 'link.php';
include mnminclude . 'smartyvariables.php';
include mnminclude . 'csrf.php';
check_referrer();
$CSRF = new csrf();
if (!isset($_POST['email_to_submit'])) {
// we're not submitting the form
$CSRF->create('recommend', true, true);
if ($_POST['draw'] == "small") {
// small form -- the form's html is in recommend_small.tpl
$htmlid = isset($_POST['htmlid']) && is_numeric($_POST['htmlid']) ? $_POST['htmlid'] : 0;
$linkid = isset($_POST['linkid']) && is_numeric($_POST['linkid']) ? $_POST['linkid'] : 0;
$main_smarty->assign('ts_random', rand(10000000, 99999999));
$main_smarty->assign('Default_Message', Default_Message);
$main_smarty->assign('link_shakebox_index', $htmlid);
$main_smarty->assign('link_id', $linkid);
$main_smarty->assign('instpath', my_base_url . my_pligg_base . "/");
$main_smarty->display($the_template . '/recommend_small.tpl');
}
} else {
$amIgod = 0;
$amIgod = $amIgod + checklevel('god');
$main_smarty->assign('amIgod', $amIgod);
$canIhaveAccess = 0;
$canIhaveAccess = $canIhaveAccess + checklevel('god');
if ($canIhaveAccess == 0) {
// $main_smarty->assign('tpl_center', '/admin/admin_access_denied');
// $main_smarty->display($template_dir . '/admin/admin.tpl');
header("Location: " . getmyurl('login', $_SERVER['REQUEST_URI']));
die;
}
// sidebar
$main_smarty = do_sidebar($main_smarty);
if ($canIhaveAccess == 1) {
global $offset;
$CSRF = new csrf();
// Items per page drop-down
if (isset($_GET["pagesize"]) && is_numeric($_GET["pagesize"])) {
misc_data_update('pagesize', $_GET["pagesize"]);
}
$pagesize = get_misc_data('pagesize');
if ($pagesize <= 0) {
$pagesize = 30;
}
$main_smarty->assign('pagesize', $pagesize);
// figure out what "page" of the results we're on
$offset = (get_current_page() - 1) * $pagesize;
// if user is searching
if ($_GET["keyword"] && $_GET["keyword"] != $main_smarty->get_config_vars('PLIGG_Visual_Search_SearchDefaultText')) {
$search_sql = " AND (comment_content LIKE '%" . sanitize($_GET["keyword"], 3) . "%' OR user_login LIKE '%" . sanitize($_GET["keyword"], 3) . "%')";
}
/**
* Remove from favorites
*
* @param int|string $event_id
*/
public function _favorite_delete($event_id)
{
$this->history = false;
// for authenticated only
if ($this->user && csrf::valid()) {
// require valid user
$this->event = new Event_Model((int) $event_id);
if ($this->event->id) {
$this->event->delete_favorite($this->user);
}
}
url::back('/members');
}
<?php
session_start();
include 'php/csrf.class.php';
$csrf = new csrf();
// Generate Token Id and Valid
$token_id = $csrf->get_token_id();
$token_value = $csrf->get_token($token_id);
// Generate Random Form Names
$form_names = $csrf->form_names(array('email', 'name', 'referer'), false);
?>
<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="description" content="" />
<meta name="keywords" content="" />
<meta name="author" content="" />
<title>Помощь в продаже автомобиля. Минимальная стоимость услуги, удобно и безопасно | ReadyMotors.ru</title>
<link href="favicon.ico" rel="shortcut icon" type="image/x-icon">
<link rel="stylesheet" media="screen" href="css/reset.css"/>
<link rel="stylesheet" media="screen" href="css/style.css"/>
<link rel="stylesheet" media="screen" href="css/nivo-slider.css"/>
<link rel="stylesheet" media="screen" href="fancybox/jquery.fancybox-1.3.4.css"/>
<script src="js/jquery-1.9.1.min.js" type="text/javascript"></script>
<script src="js/modernizr-1.5.min.js" type="text/javascript"></script>
<link href='http://fonts.googleapis.com/css?family=Cuprum:400,700&subset=cyrillic' rel='stylesheet' type='text/css'>
</head>
<body>
/**
* Shortcut for CSRF functions
*
* @param string $type - either "set" or "check" CSRF key
* @param string $script - optional name of page using the key
* @param int $life - minutes before the token expires
* @return string $key (if using $type "fetch")
*/
public function csrf($type = 'check', $script = '', $life = 60)
{
// check whether we are specifically being told not to create a newToken first
// this is required for many js scripts ajaxing back Hotaru and accidentaly setting a new token in session state, preventing form from posting correctly on csrf check
// if(isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest') {
// return true;
// }
// above ajax test didnt work so use this hard set test
$newToken = $this->cage->post->testAlnum('newToken');
if ($newToken == 'false') {
return true;
}
$csrf = \csrf::instance();
return $csrf->csrfInit($this, $type, $script, $life);
}
/**
* Creates CSRF token input
*
* @param mixed $id e.g. uid
* @param string $action optional action
*/
public static function csrf($id = '', $action = '')
{
return form::hidden('token', csrf::token($id, $action));
}
<?php
session_start();
include 'php/csrf.class.php';
$check = 'Спасибо, ваше сообщение отправлено';
$csrf = new csrf();
$token_id = $csrf->get_token_id();
$token_value = $csrf->get_token($token_id);
$form_names = $csrf->form_names(array('email', 'name', 'referer'), false);
if (isset($_POST[$form_names['name']], $_POST[$form_names['email']])) {
// Check if token id and token value are valid.
if ($csrf->check_valid('post')) {
// Get the Form Variables.
$name = $_POST[$form_names['name']];
$email = $_POST[$form_names['email']];
$ref = $_POST[$form_names['referer']];
//$to='*****@*****.**';
$to = '*****@*****.**';
$headers = "From: admin@readymotors.ru\r\n" . 'Reply-To: ' . $email . "\r\n" . 'X-Mailer: PHP/' . phpversion();
$subject = 'Главная форма || Новый лид';
$body .= 'Имя: ' . $name . "\n";
$body .= 'Телефон: ' . $email . "\n";
$body .= 'Откуда пришел: ' . $ref . "\n";
mail($to, $subject, $body, $headers);
}
$form_names = $csrf->form_names(array('name', 'email', 'referer'), true);
} else {
echo "string";
$check = 'Сообщение не отправлено. Пожалуйста, проверьте правильность введенных данных и повторите попытку.';
}
?>
<?php
/**
* This code is part of the Tutsplus course PHP Security Pitfalls.
* It is meant for demonstration purposes only.
* Do not use this code in a production environment!
*/
require 'functions.php';
require 'csrf.php';
$csrf = new csrf();
if (!empty($_SESSION['loggedin']) && $_SESSION['loggedin'] === TRUE) {
$account = isset($_GET['account']) ? (int) $_GET['account'] : 0;
$amount = isset($_GET['amount']) ? (int) $_GET['amount'] : 0;
if ($account > 0 && $amount > 0) {
// Transfer
$token = $csrf->get_token_from_url();
if ($csrf->check_token($token) == FALSE) {
die('You rascal!');
}
$filename = 'transfers.txt';
$data = file_get_contents($filename);
$msg = "A transfer of {$amount} has been made to account {$account}\n";
$data .= $msg;
file_put_contents($filename, $data);
echo $msg;
} else {
$token = $csrf->get_token();
echo '<h1>No transfer could be made</h1>';
echo '<a href="index.php?amount=10&account=1234&token=' . $token . '">Transfer $10 into account 1234</a>';
}
} else {
$canIhaveAccess = $canIhaveAccess + checklevel('admin');
if ($canIhaveAccess == 0) {
// $main_smarty->assign('tpl_center', '/admin/admin_access_denied');
// $main_smarty->display($template_dir . '/admin/admin.tpl');
header("Location: " . getmyurl('login', $_SERVER['REQUEST_URI']));
die;
}
// read the mysql database to get the pligg version
$sql = "SELECT data FROM " . table_misc_data . " WHERE name = 'pligg_version'";
$pligg_version = $db->get_var($sql);
$main_smarty->assign('version_number', $pligg_version);
// sidebar
$main_smarty = do_sidebar($main_smarty);
if ($canIhaveAccess == 1) {
// sessions used to prevent CSRF
$CSRF = new csrf();
if (isset($_POST['submit'])) {
if ($_POST["enabled"]) {
$CSRF->check_expired('admin_users_list');
if ($CSRF->check_valid(sanitize($_POST['token'], 3), 'admin_users_list')) {
foreach ($_POST["enabled"] as $id => $value) {
$_GET['id'] = $id = $db->escape($id);
$value = $db->escape($value);
$user = $db->get_row('SELECT * FROM ' . table_users . " where user_id={$id}");
if ($user->user_enabled != $value) {
canIChangeUser($user->user_level);
$db->query("UPDATE " . table_users . " SET user_enabled='{$value}', user_level=IF(user_level='Spammer','normal',user_level) WHERE user_id='" . $db->escape($id) . "'");
}
}
} else {
$CSRF->show_invalid_error(1);
>
<?php
echo html::avatar($post->author->avatar, $post->author->username);
?>
<span class="actions">
<?php
if ($my) {
?>
<?php
echo html::anchor('forum/post/' . $post->id . '/edit', __('Edit'), array('class' => 'action post-edit'));
?>
<?php
echo html::anchor('forum/post/' . $post->id . '/delete/?token=' . csrf::token(), __('Delete'), array('class' => 'action post-delete'));
?>
<?php
}
?>
<?php
if ($topic->has_access(Forum_Topic_Model::ACCESS_WRITE)) {
?>
<?php
echo html::anchor('forum/post/' . $post->id . '/quote', __('Quote'), array('class' => 'action post-quote'));
?>
<?php
}
/**
* Validate by processing pre-filters, rules, callbacks, and post-filters.
* All fields that have filters, rules, or callbacks will be initialized if
* they are undefined. Validation will only be run if there is data already
* in the array.
*
* @param bool $validate_csrf When TRUE, performs CSRF token validation
* @return bool
*/
public function validate($validate_csrf = TRUE)
{
// CSRF token field
$csrf_token_key = 'form_auth_token';
if (array_key_exists($csrf_token_key, $this)) {
unset($this[$csrf_token_key]);
}
// Delete the CSRF token field if it's in the validation
// rules
if (array_key_exists($csrf_token_key, $this->callbacks)) {
unset($this->callbacks[$csrf_token_key]);
} elseif (array_key_exists($csrf_token_key, $this->rules)) {
unset($this->rules[$csrf_token_key]);
}
// Disable CSRF for XHR
// Same method as django CSRF protection:
// http://michael-coates.blogspot.co.nz/2010/12/djangos-built-in-csrf-defense-for-ajax.html
if (request::is_ajax()) {
$validate_csrf = FALSE;
}
// Perform CSRF validation for all HTTP POST requests
// where CSRF validation is enabled and the request
// was not submitted via the API
if ($_POST and $validate_csrf and !Validation::$is_api_request) {
// Check if CSRF module is loaded
if (in_array(MODPATH . 'csrf', Kohana::config('config.modules'))) {
// Check for presence of CSRF token in HTTP POST payload
$form_auth_token = isset($_POST[$csrf_token_key]) ? $_POST[$csrf_token_key] : text::random('alnum', 10);
// Validate the token
if (!csrf::valid($form_auth_token)) {
Kohana::log('debug', 'Invalid CSRF token: ' . $form_auth_token);
Kohana::log('debug', 'Actual CSRF token: ' . csrf::token());
// Flag CSRF validation as having failed
$this->csrf_validation_failed = TRUE;
// Set the error message
$this->errors[$csrf_token_key] = Kohana::lang('csrf.form_auth_token.error');
return FALSE;
}
}
}
// All the fields that are being validated
$all_fields = array_unique(array_merge(array_keys($this->pre_filters), array_keys($this->rules), array_keys($this->callbacks), array_keys($this->post_filters)));
// Copy the array from the object, to optimize multiple sets
$object_array = $this->getArrayCopy();
foreach ($all_fields as $i => $field) {
if ($field === $this->any_field) {
// Remove "any field" from the list of fields
unset($all_fields[$i]);
continue;
}
if (substr($field, -2) === '.*') {
// Set the key to be an array
Kohana::key_string_set($object_array, substr($field, 0, -2), array());
} else {
// Set the key to be NULL
Kohana::key_string_set($object_array, $field, NULL);
}
}
// Swap the array back into the object
$this->exchangeArray($object_array);
// Reset all fields to ALL defined fields
$all_fields = array_keys($this->getArrayCopy());
foreach ($this->pre_filters as $field => $calls) {
foreach ($calls as $func) {
if ($field === $this->any_field) {
foreach ($all_fields as $f) {
// Process each filter
$this[$f] = is_array($this[$f]) ? arr::map_recursive($func, $this[$f]) : call_user_func($func, $this[$f]);
}
} else {
// Process each filter
$this[$field] = is_array($this[$field]) ? arr::map_recursive($func, $this[$field]) : call_user_func($func, $this[$field]);
}
}
}
if ($this->submitted === FALSE) {
return FALSE;
}
foreach ($this->rules as $field => $calls) {
foreach ($calls as $call) {
// Split the rule into function and args
list($func, $args) = $call;
if ($field === $this->any_field) {
foreach ($all_fields as $f) {
if (isset($this->array_fields[$f])) {
// Use the field key
$f_key = $this->array_fields[$f];
// Prevent other rules from running when this field already has errors
if (!empty($this->errors[$f_key])) {
break;
}
// Don't process rules on empty fields
if (!in_array($func[1], $this->empty_rules, TRUE) and $this[$f_key] == NULL) {
continue;
}
foreach ($this[$f_key] as $k => $v) {
if (!call_user_func($func, $this[$f_key][$k], $args)) {
// Run each rule
$this->errors[$f_key] = is_array($func) ? $func[1] : $func;
}
}
} else {
// Prevent other rules from running when this field already has errors
if (!empty($this->errors[$f])) {
break;
}
// Don't process rules on empty fields
if (!in_array($func[1], $this->empty_rules, TRUE) and $this[$f] == NULL) {
continue;
}
if (!call_user_func($func, $this[$f], $args)) {
// Run each rule
$this->errors[$f] = is_array($func) ? $func[1] : $func;
}
}
}
} else {
if (isset($this->array_fields[$field])) {
// Use the field key
$field_key = $this->array_fields[$field];
// Prevent other rules from running when this field already has errors
if (!empty($this->errors[$field_key])) {
break;
}
// Don't process rules on empty fields
if (!in_array($func[1], $this->empty_rules, TRUE) and $this[$field_key] == NULL) {
continue;
}
foreach ($this[$field_key] as $k => $val) {
if (!call_user_func($func, $this[$field_key][$k], $args)) {
// Run each rule
$this->errors[$field_key] = is_array($func) ? $func[1] : $func;
// Stop after an error is found
break 2;
}
}
} else {
// Prevent other rules from running when this field already has errors
if (!empty($this->errors[$field])) {
break;
}
// Don't process rules on empty fields
if (!in_array($func[1], $this->empty_rules, TRUE) and $this[$field] == NULL) {
continue;
}
if (!call_user_func($func, $this[$field], $args)) {
// Run each rule
$this->errors[$field] = is_array($func) ? $func[1] : $func;
// Stop after an error is found
break;
}
}
}
}
}
foreach ($this->callbacks as $field => $calls) {
foreach ($calls as $func) {
if ($field === $this->any_field) {
foreach ($all_fields as $f) {
// Execute the callback
call_user_func($func, $this, $f);
// Stop after an error is found
if (!empty($errors[$f])) {
break 2;
}
}
} else {
// Execute the callback
call_user_func($func, $this, $field);
// Stop after an error is found
if (!empty($errors[$field])) {
break;
}
}
}
}
foreach ($this->post_filters as $field => $calls) {
foreach ($calls as $func) {
if ($field === $this->any_field) {
foreach ($all_fields as $f) {
if (isset($this->array_fields[$f])) {
// Use the field key
$f = $this->array_fields[$f];
}
// Process each filter
$this[$f] = is_array($this[$f]) ? array_map($func, $this[$f]) : call_user_func($func, $this[$f]);
}
} else {
if (isset($this->array_fields[$field])) {
// Use the field key
$field = $this->array_fields[$field];
}
// Process each filter
$this[$field] = is_array($this[$field]) ? array_map($func, $this[$field]) : call_user_func($func, $this[$field]);
}
}
}
// Return TRUE if there are no errors
return count($this->errors) === 0;
}
/**
* User profile
*/
public function _view()
{
$this->tab_id = 'profile';
$owner = $this->user && $this->member->id == $this->user->id;
if ($owner && $this->user->newcomments) {
$this->user->newcomments = 0;
$this->user->save();
}
// Actions
if ($this->member->has_access(User_Model::ACCESS_EDIT)) {
$this->page_actions[] = array('link' => url::user($this->member) . '/edit', 'text' => __('Settings'), 'class' => 'settings');
}
// Picture
widget::add('side', View_Mod::factory('member/member', array('mod_class' => 'member member-' . $this->member->id, 'user' => $this->member)));
// Comments
if ($this->member->has_access(User_Model::ACCESS_COMMENT)) {
$comment = new User_Comment_Model();
$form_values = $comment->as_array();
$form_errors = array();
// check post
if (csrf::valid() && ($post = $this->input->post())) {
$comment->user_id = $this->member->id;
$comment->author_id = $this->user->id;
$comment->comment = $post['comment'];
if (isset($post['private'])) {
$comment->private = 1;
}
try {
$comment->save();
if (!$owner) {
$this->member->newcomments += 1;
$this->member->save();
}
$this->user->commentsleft += 1;
$this->user->save();
if (!request::is_ajax()) {
url::redirect(url::current());
}
} catch (ORM_Validation_Exception $e) {
$form_errors = $e->validation->errors();
$form_values = arr::overwrite($form_values, $post);
}
}
// Handle pagination
$per_page = 25;
$page_num = $this->uri->segment('page') ? $this->uri->segment('page') : 1;
$page_offset = ($page_num - 1) * $per_page;
$total_comments = $this->member->get_comment_count();
$comments = $this->member->find_comments($page_num, $per_page, $this->user);
$pagination = new Pagination(array('items_per_page' => $per_page, 'total_items' => $total_comments));
$view = View::factory('generic/comments', array('delete' => '/member/comment/%d/delete/?token=' . csrf::token(), 'private' => '/member/comment/%d/private/?token=' . csrf::token(), 'comments' => $comments, 'errors' => $form_errors, 'values' => $form_values, 'pagination' => $pagination, 'user' => $this->user));
if (request::is_ajax()) {
echo $view;
return;
}
widget::add('main', $view);
}
// Basic info
$basic_info = array();
if (!empty($this->member->name)) {
$basic_info[__('Name')] = html::specialchars($this->member->name);
}
if (!empty($this->member->city_name)) {
$basic_info[__('City')] = html::specialchars($this->member->city_name);
}
if (!empty($this->member->dob) && $this->member->dob != '0000-00-00') {
$basic_info[__('Date of Birth')] = __(':dob (:years years)', array(':dob' => date::format('DMYYYY', $this->member->dob), ':years' => date::timespan(strtotime($this->member->dob), null, 'years')));
}
if (!empty($this->member->gender)) {
$basic_info[__('Gender')] = $this->member->gender == 'm' ? __('Male') : __('Female');
}
if (!empty($this->member->latitude) && !empty($this->member->longitude)) {
$basic_info[__('Location')] = $this->member->latitude . ', ' . $this->member->longitude;
$basic_info[__('Location')] = html::anchor('#map', __('Toggle map'), array('class' => 'expander', 'title' => __('Show/hide'))) . '<div id="map" style="display: none">' . __('Map loading') . '</div>';
$map = new Gmap('map', array('ScrollWheelZoom' => true));
$map->center($this->member->latitude, $this->member->longitude, 15)->controls('small')->types();
$map->add_marker($this->member->latitude, $this->member->longitude, html::avatar($this->member->avatar, $this->member->username) . html::user($this->member));
widget::add('foot', html::script_source($map->render('gmaps/jquery_event')));
widget::add('foot', html::script_source("\$('a[href*=\"#map\"]:first').click(function() { \$('#map').toggle('normal', gmap_open); return false; });"));
}
// Site info
$site_info = array(__('Registered') => date::format('DMYYYY_HM', $this->member->created) . ' [#' . $this->member->id . ']', __('Logins') => __(':logins (:ago ago)', array(':logins' => number_format($this->member->logins, 0), ':ago' => '<abbr title="' . date::format('DMYYYY_HM', $this->member->last_login) . '">' . date::timespan_short($this->member->last_login) . '</abbr>')), __('Posts') => number_format($this->member->posts, 0), __('Comments') => number_format($this->member->commentsleft, 0));
// Initialize tabs
$tabs = array('basic-info' => array('href' => '#basic-info', 'title' => __('Basic info'), 'tab' => new View('generic/list_info', array('id' => 'basic-info', 'title' => __('Basic info'), 'list' => $basic_info))), 'site-info' => array('href' => '#site-info', 'title' => __('Site info'), 'tab' => new View('generic/list_info', array('id' => 'site-info', 'title' => __('Site info'), 'list' => $site_info))));
widget::add('side', View::factory('generic/tabs', array('id' => 'info-tab', 'tabs' => $tabs)));
$this->_side_views();
}
raintpl::configure("cache_dir", "cache/");
//initialize a Rain TPL object
$tpl = new RainTPL();
$tpl->assign("theme", $theme);
$tpl->assign("title", $title);
$tpl->assign("headingtitletxt", $headingtitletxt);
$tpl->assign("addentrytxt", $addentrytxt);
$tpl->assign("viewguestbooktxt", $viewguestbooktxt);
$tpl->assign("newpostfirsttxt", $newpostfirsttxt);
$tpl->assign("newpostlasttxt", $newpostlasttxt);
$tpl->assign("searchlabeltxt", $searchlabeltxt);
$tpl->assign("searchbuttontxt", $searchbuttontxt);
$tpl->assign("currentyear", date("Y"));
$tpl->assign("goback", $goback);
// Validate Form Token
$csrf = new csrf();
if ($csrf->check_valid('post') == false) {
$tpl->assign("error_msg", $errorFormToken);
$html = $tpl->draw('error', $return_string = true);
echo $html;
exit;
}
// Image Verification Classic
if ($image_verify == 1) {
$number = $_POST['txtNumber'];
if (md5($number) != $_SESSION['image_random_value']) {
$tpl->assign("error_msg", $errorImageVerification);
$html = $tpl->draw('error', $return_string = true);
echo $html;
exit;
}
/**
* Edit topic
*
* @param mixed $topic_id
* @param mixed $area_id
*/
public function _topic_edit($topic_id, $area_id = false)
{
$this->history = false;
$errors = array();
$forum_topic = new Forum_Topic_Model((int) $topic_id);
$forum_area = $forum_topic->loaded() ? $forum_topic->forum_area : new Forum_Area_Model((int) $area_id);
if ($forum_topic->loaded()) {
// Editing topic
$editing = true;
if (!$forum_topic->has_access(Forum_Topic_Model::ACCESS_EDIT)) {
url::back('forum');
}
} else {
if ($forum_area->loaded()) {
// New topic
$editing = false;
if (!$forum_area->has_access(Forum_Area_Model::ACCESS_WRITE)) {
url::back('forum');
}
} else {
// New topic in unknown area
$errors[] = __('Area :area or topic :topic not found', array(':area' => (int) $area_id, ':topic' => (int) $topic_id));
}
}
if (empty($errors)) {
$forum_post = new Forum_Post_Model((int) $forum_topic->first_post_id);
$form_errors = array();
$form_values_topic = $forum_topic->as_array();
$form_values_post = $forum_post->as_array();
$form_topics = false;
// Bound area?
if ($forum_area->is_type(Forum_Area_Model::TYPE_BIND)) {
// Get bind config and load topics
$bind = Forum_Area_Model::binds($forum_area->bind);
if ($editing) {
// Can't edit bound topic
$form_topics = array($forum_topic->bind_id => $forum_topic->name);
} else {
// Try to load options from configured model
try {
$bind_topics = ORM::factory($bind['model'])->find_bind_topics($forum_area->bind);
$form_topics = array(0 => __('Choose..')) + $bind_topics;
} catch (Kohana_Exception $e) {
$form_topics = array();
}
}
}
// Admin actions
if ($editing && $forum_topic->has_access(Forum_Topic_Model::ACCESS_DELETE)) {
$this->page_actions[] = array('link' => url::model($forum_topic) . '/delete/?token=' . csrf::token(), 'text' => __('Delete topic'), 'class' => 'topic-delete');
}
// Check post
if ($post = $this->input->post()) {
$post['forum_area_id'] = $forum_area->id;
$topic = $post;
if (isset($bind_topics)) {
$topic['name'] = arr::get($bind_topics, (int) $topic['bind_id'], '');
}
$post_extra = $topic_extra = array('author_id' => $this->user->id, 'author_name' => $this->user->username);
if ($editing) {
$post_extra['modifies'] = (int) $forum_post->modifies + 1;
$post_extra['modified'] = date::unix2sql(time());
}
$post_extra['author_ip'] = $this->input->ip_address();
$post_extra['author_host'] = $this->input->host_name();
// validate post first and save topic if ok
if (csrf::valid() && $forum_post->validate($post, false, $post_extra) && $forum_topic->validate($topic, true, $topic_extra)) {
// post
$forum_post->forum_topic_id = $forum_topic->id;
$forum_post->save();
if (!$editing) {
// topic
$forum_topic->first_post_id = $forum_post->id;
$forum_topic->last_post_id = $forum_post->id;
$forum_topic->last_poster = $this->user->username;
$forum_topic->last_posted = date::unix2sql(time());
$forum_topic->posts = 1;
$forum_topic->save();
// area
$forum_area->last_topic_id = $forum_topic->id;
$forum_area->posts += 1;
$forum_area->topics += 1;
$forum_area->save();
// user
$this->user->posts += 1;
$this->user->save();
// News feed
newsfeeditem_forum::topic($this->user, $forum_topic);
}
// redirect back to topic
URL::redirect(url::model($forum_topic));
} else {
$form_errors = array_merge($post->errors(), is_object($topic) ? $topic->errors() : array());
}
$form_values_topic = arr::overwrite($form_values_topic, is_object($topic) ? $topic->as_array() : $topic);
$form_values_post = arr::overwrite($form_values_post, $post->as_array());
}
}
// Show form
if (empty($errors)) {
$this->breadcrumb[] = html::anchor(url::model($forum_area), text::title($forum_area->name));
$this->page_title = $editing ? text::title($forum_topic->name) : __('New topic');
$this->page_subtitle = __('Area :area', array(':area' => html::anchor(url::model($forum_area), text::title($forum_area->name), array('title' => strip_tags($forum_area->description)))));
widget::add('head', html::script(array('js/jquery.markitup.pack', 'js/markitup.bbcode')));
widget::add('main', View_Mod::factory('forum/topic_edit', array('topic' => $form_values_topic, 'topics' => $form_topics, 'post' => $form_values_post, 'errors' => $form_errors)));
} else {
$this->_error(__('Error'), $errors);
}
$this->_side_views();
}
<?php
include_once 'internal/Smarty.class.php';
$main_smarty = new Smarty();
include 'config.php';
include mnminclude . 'html1.php';
include mnminclude . 'link.php';
include mnminclude . 'group.php';
include mnminclude . 'user.php';
include mnminclude . 'friend.php';
include mnminclude . 'smartyvariables.php';
include mnminclude . 'csrf.php';
check_referrer();
$CSRF = new csrf();
$offset = (get_current_page() - 1) * $page_size;
$main_smarty = do_sidebar($main_smarty);
define('pagename', 'user');
$main_smarty->assign('pagename', pagename);
// if not logged in, redirect to the index page
$login = isset($_COOKIE['mnm_user']) ? sanitize($_COOKIE['mnm_user'], 3) : '';
//$login = isset($_GET['login']) ? sanitize($_GET['login'], 3) : '';
if ($login === '') {
if ($current_user->user_id > 0) {
$login = $current_user->user_login;
} else {
header('Location: ./');
die;
}
}
if (Allow_User_Change_Templates && file_exists("./templates/" . $_POST['template'] . "/header.tpl")) {
$domain = $_SERVER['HTTP_HOST'] == 'localhost' ? '' : preg_replace('/^www/', '', $_SERVER['HTTP_HOST']);
$interests = interest::get_by_user($_SESSION['user']['id']);
if (!is_array($interests) || count($interests) == 0) {
?>
<p>No interest at the moment!</p>
<?php
} else {
echo '<ul>';
foreach ($interests as $interest) {
$id = $interest['id'];
$name = $interest['name'];
$description = $interest['description'];
echo '<li>' . $name . ': ' . $description . ' <a href=\'?p=interests&action=remove&id=' . $id . '\' title=\'Remove this interest\'>Remove</a></li>';
}
echo '</ul>';
}
?>
<h3>Create new interest</h3>
<form method="POST" action="?p=interests&action=add">
<input type="hidden" name="csrf_token" value="<?php
echo csrf::generate_signed_token();
?>
" />
<label for="name">Name: </label><input type="text" name="name" id="name" /><br />
<label for="description">Description: </label><br />
<textarea name="description" placeholder="Description optional"></textarea>
<br />
<input type="submit" value="Create interest" />
</form>
// email change successful
echo '<p style="color:green;">Mail has been successfuly changed!</p>';
} elseif (!empty($_POST['email'])) {
// email change request
$result = user::change_email($_SESSION['user']['id'], $_POST['email']);
if ($result) {
redirect('?p=account&action=email&ok');
die;
} else {
echo '<p>Impossible to change email!</p>';
}
}
} elseif ($action == 'delete') {
if (!empty($_POST['csrf_token'])) {
$token = $_POST['csrf_token'];
$valid = csrf::check($token, $_SESSION['token']);
if ($valid) {
$result = user::delete($_SESSION['user']['id']);
if ($result) {
redirect('?p=disconnect&delete');
die;
} else {
echo '<p>Impossible to delete this account!</p>';
}
} else {
echo '<p style="color:red;">Wrong CSRF token!</p>';
}
}
} else {
// unknown action
}