TokenBuildBehavior.class.php
2.63 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
<?php
// +----------------------------------------------------------------------
// | TOPThink [ WE CAN DO IT JUST THINK ]
// +----------------------------------------------------------------------
// | Copyright (c) 2010 http://topthink.com All rights reserved.
// +----------------------------------------------------------------------
// | Licensed ( http://www.apache.org/licenses/LICENSE-2.0 )
// +----------------------------------------------------------------------
// | Author: liu21st <liu21st@gmail.com>
// +----------------------------------------------------------------------
namespace Behavior;
/**
* 系统行为扩展：表单令牌生成
*/
class TokenBuildBehavior
{
public function run(&$content)
{
if (C('TOKEN_ON')) {
list ($tokenName, $tokenKey, $tokenValue) = $this->getToken();
$input_token = '<input type="hidden" name="' . $tokenName . '" value="' . $tokenKey . '_' . $tokenValue . '" />';
$meta_token = '<meta name="' . $tokenName . '" content="' . $tokenKey . '_' . $tokenValue . '" />';
if (strpos($content, '{__TOKEN__}')) {
// 指定表单令牌隐藏域位置
$content = str_replace('{__TOKEN__}', $input_token, $content);
} elseif (preg_match('/<\/form(\s*)>/is', $content, $match)) {
// 智能生成表单令牌隐藏域
$content = str_replace($match[0], $input_token . $match[0], $content);
}
$content = str_ireplace('</head>', $meta_token . '</head>', $content);
} else {
$content = str_replace('{__TOKEN__}', '', $content);
}
}
// 获得token
private function getToken()
{
$tokenName = C('TOKEN_NAME', null, '__hash__');
$tokenType = C('TOKEN_TYPE', null, 'md5');
if (! isset($_SESSION[$tokenName])) {
$_SESSION[$tokenName] = array();
}
// 标识当前页面唯一性
$tokenKey = md5($_SERVER['REQUEST_URI']);
if (isset($_SESSION[$tokenName][$tokenKey])) { // 相同页面不重复生成session
$tokenValue = $_SESSION[$tokenName][$tokenKey];
} else {
$tokenValue = is_callable($tokenType) ? $tokenType(microtime(true)) : md5(microtime(true));
$_SESSION[$tokenName][$tokenKey] = $tokenValue;
if (IS_AJAX && C('TOKEN_RESET', null, true)) {
header($tokenName . ': ' . $tokenKey . '_' . $tokenValue);
} // ajax需要获得这个header并替换页面中meta中的token值
}
return array(
$tokenName,
$tokenKey,
$tokenValue
);
}
}