namespace Friendica;
use Friendica\Core\Logger;
+use Friendica\Model\User;
/**
* All modules in Friendica should extend BaseModule, although not all modules
return $o;
}
+ /**
+ * Module DELETE method to process submitted data
+ *
+ * Extend this method if the module is supposed to process DELETE requests.
+ * Doesn't display any content
+ */
+ public static function delete(array $parameters = [])
+ {
+ }
+
+ /**
+ * Module PATCH method to process submitted data
+ *
+ * Extend this method if the module is supposed to process PATCH requests.
+ * Doesn't display any content
+ */
+ public static function patch(array $parameters = [])
+ {
+ }
+
/**
* Module POST method to process submitted data
*
{
}
+ /**
+ * Module PUT method to process submitted data
+ *
+ * Extend this method if the module is supposed to process PUT requests.
+ * Doesn't display any content
+ */
+ public static function put(array $parameters = [])
+ {
+ }
+
/*
* Functions used to protect against Cross-Site Request Forgery
* The security token has to base on at least one value that an attacker can't know - here it's the session ID and the private key.
*/
public static function getFormSecurityToken($typename = '')
{
- $a = DI::app();
-
+ $user = User::getById(DI::app()->getLoggedInUserId(), ['guid', 'prvkey']);
$timestamp = time();
- $sec_hash = hash('whirlpool', ($a->user['guid'] ?? '') . ($a->user['prvkey'] ?? '') . session_id() . $timestamp . $typename);
+ $sec_hash = hash('whirlpool', ($user['guid'] ?? '') . ($user['prvkey'] ?? '') . session_id() . $timestamp . $typename);
return $timestamp . '.' . $sec_hash;
}
$max_livetime = 10800; // 3 hours
- $a = DI::app();
+ $user = User::getById(DI::app()->getLoggedInUserId(), ['guid', 'prvkey']);
$x = explode('.', $hash);
if (time() > (intval($x[0]) + $max_livetime)) {
return false;
}
- $sec_hash = hash('whirlpool', ($a->user['guid'] ?? '') . ($a->user['prvkey'] ?? '') . session_id() . $x[0] . $typename);
+ $sec_hash = hash('whirlpool', ($user['guid'] ?? '') . ($user['prvkey'] ?? '') . session_id() . $x[0] . $typename);
return ($sec_hash == $x[1]);
}
public static function checkFormSecurityTokenRedirectOnError($err_redirect, $typename = '', $formname = 'form_security_token')
{
if (!self::checkFormSecurityToken($typename, $formname)) {
- $a = DI::app();
- Logger::log('checkFormSecurityToken failed: user ' . $a->user['guid'] . ' - form element ' . $typename);
+ Logger::log('checkFormSecurityToken failed: user ' . DI::app()->getLoggedInUserNickname() . ' - form element ' . $typename);
Logger::log('checkFormSecurityToken failed: _REQUEST data: ' . print_r($_REQUEST, true), Logger::DATA);
notice(self::getFormSecurityStandardErrorMessage());
DI::baseUrl()->redirect($err_redirect);
public static function checkFormSecurityTokenForbiddenOnError($typename = '', $formname = 'form_security_token')
{
if (!self::checkFormSecurityToken($typename, $formname)) {
- $a = DI::app();
- Logger::log('checkFormSecurityToken failed: user ' . $a->user['guid'] . ' - form element ' . $typename);
+ Logger::log('checkFormSecurityToken failed: user ' . DI::app()->getLoggedInUserNickname() . ' - form element ' . $typename);
Logger::log('checkFormSecurityToken failed: _REQUEST data: ' . print_r($_REQUEST, true), Logger::DATA);
throw new \Friendica\Network\HTTPException\ForbiddenException();