You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
54 lines
2.5 KiB
PHTML
54 lines
2.5 KiB
PHTML
5 years ago
|
<?php
|
||
|
|
// +----------------------------------------------------------------------
|
||
|
|
// | TOPThink [ WE CAN DO IT JUST THINK ]
|
||
|
|
// +----------------------------------------------------------------------
|
||
|
|
// | Copyright (c) 2010 http://topthink.com All rights reserved.
|
||
|
|
// +----------------------------------------------------------------------
|
||
|
|
// | Licensed ( http://www.apache.org/licenses/LICENSE-2.0 )
|
||
|
|
// +----------------------------------------------------------------------
|
||
|
|
// | Author: liu21st <liu21st@gmail.com>
|
||
|
|
// +----------------------------------------------------------------------
|
||
|
|
namespace Behavior;
|
||
|
|
/**
|
||
|
|
* 系统行为扩展：表单令牌生成
|
||
|
|
*/
|
||
|
|
class TokenBuildBehavior {
|
||
|
|
|
||
|
|
public function run(&$content){
|
||
|
|
if(C('TOKEN_ON')) {
|
||
|
|
list($tokenName,$tokenKey,$tokenValue)=$this->getToken();
|
||
|
|
$input_token = '<input type="hidden" name="'.$tokenName.'" value="'.$tokenKey.'_'.$tokenValue.'" />';
|
||
|
|
$meta_token = '<meta name="'.$tokenName.'" content="'.$tokenKey.'_'.$tokenValue.'" />';
|
||
|
|
if(strpos($content,'{__TOKEN__}')) {
|
||
|
|
// 指定表单令牌隐藏域位置
|
||
|
|
$content = str_replace('{__TOKEN__}',$input_token,$content);
|
||
|
|
}elseif(preg_match('/<\/form(\s*)>/is',$content,$match)) {
|
||
|
|
// 智能生成表单令牌隐藏域
|
||
|
|
$content = str_replace($match[0],$input_token.$match[0],$content);
|
||
|
|
}
|
||
|
|
$content = str_ireplace('</head>',$meta_token.'</head>',$content);
|
||
|
|
}else{
|
||
|
|
$content = str_replace('{__TOKEN__}','',$content);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
//获得token
|
||
|
|
private function getToken(){
|
||
|
|
$tokenName = C('TOKEN_NAME',null,'__hash__');
|
||
|
|
$tokenType = C('TOKEN_TYPE',null,'md5');
|
||
|
|
if(!isset($_SESSION[$tokenName])) {
|
||
|
|
$_SESSION[$tokenName] = array();
|
||
|
|
}
|
||
|
|
// 标识当前页面唯一性
|
||
|
|
$tokenKey = md5($_SERVER['REQUEST_URI']);
|
||
|
|
if(isset($_SESSION[$tokenName][$tokenKey])) {// 相同页面不重复生成session
|
||
|
|
$tokenValue = $_SESSION[$tokenName][$tokenKey];
|
||
|
|
}else{
|
||
|
|
$tokenValue = is_callable($tokenType) ? $tokenType(microtime(true)) : md5(microtime(true));
|
||
|
|
$_SESSION[$tokenName][$tokenKey] = $tokenValue;
|
||
|
|
if(IS_AJAX && C('TOKEN_RESET',null,true))
|
||
|
|
header($tokenName.': '.$tokenKey.'_'.$tokenValue); //ajax需要获得这个header并替换页面中meta中的token值
|
||
|
|
}
|
||
|
|
return array($tokenName,$tokenKey,$tokenValue);
|
||
|
|
}
|
||
|
|
}
|