1 |
1337
|
Luisehahne
|
<?php
|
2 |
|
|
/**
|
3 |
|
|
*
|
4 |
|
|
* @category security
|
5 |
|
|
* @package framework
|
6 |
|
|
* @author ISTeam easy-Project
|
7 |
|
|
* @copyright 2009-2010, Independend-Software-Team
|
8 |
|
|
* @link http://easy.isteam.de/
|
9 |
|
|
* @license http://creativecommons.org/licenses/by-nc-nd/3.0/de/
|
10 |
|
|
* @platform WebsiteBaker 2.8.x
|
11 |
|
|
* @requirements PHP 4.4.9 and higher
|
12 |
|
|
* @version $Id$
|
13 |
|
|
* @filesource $HeadURL$
|
14 |
|
|
* @lastmodified $Date$
|
15 |
|
|
*
|
16 |
|
|
* SecureForm
|
17 |
|
|
* Version 0.1
|
18 |
|
|
*
|
19 |
|
|
* creates Formular transactionnumbers for unique use
|
20 |
|
|
*/
|
21 |
|
|
|
22 |
|
|
class SecureForm {
|
23 |
|
|
|
24 |
|
|
/* insert global vars here... */
|
25 |
|
|
|
26 |
|
|
var $_FTAN = '';
|
27 |
|
|
var $_IDKEYs = array();
|
28 |
|
|
|
29 |
|
|
function SecureForm()
|
30 |
|
|
{
|
31 |
|
|
// $this->__construct();
|
32 |
|
|
$this->_FTAN = '';
|
33 |
|
|
// if(isset($_SESSION['FTAN'])) { unset($_SESSION['FTAN']); }
|
34 |
|
|
}
|
35 |
|
|
// function __construct()
|
36 |
|
|
// {
|
37 |
|
|
// var $_FTAN = '';
|
38 |
|
|
// if(isset($_SESSION['FTAN'])) { unset($_SESSION['FTAN']); }
|
39 |
|
|
// }
|
40 |
|
|
|
41 |
|
|
/*
|
42 |
|
|
* creates Formular transactionnumbers for unique use
|
43 |
|
|
* @access public
|
44 |
|
|
* @param bool $asTAG: true returns a complete prepared, hidden HTML-Input-Tag (default)
|
45 |
|
|
* false returns an array including FTAN0 and FTAN1
|
46 |
|
|
* @return mixed: array or string
|
47 |
|
|
*
|
48 |
|
|
* requirements: an active session must be available
|
49 |
|
|
*/
|
50 |
|
|
function getFTAN( $as_tag = true)
|
51 |
|
|
{
|
52 |
|
|
if( $this->_FTAN == '')
|
53 |
|
|
{
|
54 |
|
|
if(function_exists('microtime'))
|
55 |
|
|
{
|
56 |
|
|
list($usec, $sec) = explode(" ", microtime());
|
57 |
|
|
$time = (string)((float)$usec + (float)$sec);
|
58 |
|
|
}else{
|
59 |
|
|
$time = (string)time();
|
60 |
|
|
}
|
61 |
|
|
$salt = ( isset($_SERVER['HTTP_ACCEPT']) ? $_SERVER['HTTP_ACCEPT'] : '');
|
62 |
|
|
$salt .= ( isset($_SERVER['HTTP_ACCEPT_CHARSET']) ? $_SERVER['HTTP_ACCEPT_CHARSET'] : '');
|
63 |
|
|
$salt .= ( isset($_SERVER['HTTP_ACCEPT_ENCODING']) ? $_SERVER['HTTP_ACCEPT_ENCODING'] : '');
|
64 |
|
|
$salt .= ( isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : '');
|
65 |
|
|
$salt .= ( isset($_SERVER['HTTP_CONNECTION']) ? $_SERVER['HTTP_CONNECTION'] : '');
|
66 |
|
|
$salt .= ( isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '');
|
67 |
|
|
$salt .= ( isset($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : '');
|
68 |
|
|
$salt = ( $salt !== '' ) ? $salt : 'eXtremelyHotTomatoJuice';
|
69 |
|
|
$this->_FTAN = md5($time.$salt);
|
70 |
|
|
$_SESSION['FTAN'] = $this->_FTAN;
|
71 |
|
|
}
|
72 |
|
|
$ftan0 = 'a'.substr($this->_FTAN, -(10 + hexdec(substr($this->_FTAN, 1))), 10);
|
73 |
|
|
$ftan1 = 'a'.substr($this->_FTAN, hexdec(substr($this->_FTAN, -1)), 10);
|
74 |
|
|
if($as_tag == true)
|
75 |
|
|
{
|
76 |
|
|
return '<input type="hidden" name="'.$ftan0.'" value="'.$ftan1.'" title="" />';
|
77 |
|
|
}else{
|
78 |
|
|
return array('FTAN0' => $ftan0, 'FTAN1' => $ftan1);
|
79 |
|
|
}
|
80 |
|
|
}
|
81 |
|
|
|
82 |
|
|
/*
|
83 |
|
|
* checks received form-transactionnumbers against session-stored one
|
84 |
|
|
* @access public
|
85 |
|
|
* @param string $mode: requestmethode POST(default) or GET
|
86 |
|
|
* @return bool: true if numbers matches against stored ones
|
87 |
|
|
*
|
88 |
|
|
* requirements: an active session must be available
|
89 |
|
|
* this check will prevent from multiple sending a form. history.back() also will never work
|
90 |
|
|
*/
|
91 |
|
|
function checkFTAN( $mode = 'POST')
|
92 |
|
|
{
|
93 |
|
|
$retval = false;
|
94 |
|
|
if(isset($_SESSION['FTAN']) && strlen($_SESSION['FTAN']) == strlen(md5('dummy')))
|
95 |
|
|
{
|
96 |
|
|
$ftan = $_SESSION['FTAN'];
|
97 |
|
|
$ftan0 = 'a'.substr($ftan, -(10 + hexdec(substr($ftan, 1))), 10);
|
98 |
|
|
$ftan1 = 'a'.substr($ftan, hexdec(substr($ftan, -1)), 10);
|
99 |
|
|
unset($_SESSION['FTAN']);
|
100 |
|
|
if(strtoupper($mode) == 'POST')
|
101 |
|
|
{
|
102 |
|
|
$retval = (isset($_POST[$ftan0]) && $_POST[$ftan0] == ($ftan1));
|
103 |
|
|
$_POST[$ftan0] = '';
|
104 |
|
|
}else{
|
105 |
|
|
$retval = (isset($_GET[$ftan0]) && $_GET[$ftan0] == ($ftan1));
|
106 |
|
|
$_GET[$ftan0] = '';
|
107 |
|
|
}
|
108 |
|
|
}
|
109 |
|
|
return $retval;
|
110 |
|
|
}
|
111 |
|
|
|
112 |
|
|
|
113 |
|
|
|
114 |
|
|
//put your code here
|
115 |
|
|
}
|
116 |
|
|
?>
|