WB 2.08.x

! = Update/Change

===============================================================================

27 Aug-2012 Build 1698 Dietmar Woellbrink (Luisehahne)

! optimize some methods

+ add method send_header, replace header('Location:...  with new method

// check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled)

if(!defined('VERSION')) define('VERSION', '2.8.3');

if(!defined('SP')) define('SP', '');

 */

##  Heavy patched version, idea for patches based on :

##  http://stackoverflow.com/questions/2695153/php-csrf-how-to-make-it-works-in-all-tabs/2695291#2695291

##  denies the use of multiple browsers.

##  You can configure this class by adding several constants to your config.php

##  http://www.gnu.org/licenses/gpl.html

##  Take a look at  __construkt  for configuration options(constants).

##  Patch version 0.3.5

/**

 * If you want some special configuration put this somewhere in your config.php for

 * example or just uncomment the lines here

 *

 * define ('WB_SECFORM_TOKENNAME','my3form3');

 * how many blocks of the IP should be used in fingerprint 0=no ipcheck, possible values 0-4

 * define ('FINGERPRINT_WITH_IP_OCTETS',2);

 */

/* -------------------------------------------------------- */

// Must include code to stop this file being accessed directly

if(!defined('WB_PATH')) {

class SecureForm {

	const FRONTEND = 0;

        ## additional private data

	private $_secret      	 = '5609bnefg93jmgi99igjefg';

        private $_tokenname   	 = 'formtoken';

	private $_useipblocks	 = 2;

	private $_usefingerprint = true;

        ### additional private data

        private $_FTAN           = '';

	/* Construtor */

	protected function __construct($mode = self::FRONTEND){

			$this->_secret=WB_SECFORM_SECRET;

		}

                if (defined ('WB_SECFORM_USEFP') AND WB_SECFORM_USEFP===false){

			$this->_usefingerprint	= false;

		}

                if (defined ('WB_SECFORM_TIMEOUT') AND is_numeric(WB_SECFORM_TIMEOUT) AND intval(WB_SECFORM_TIMEOUT) >=0 AND intval(WB_SECFORM_TIMEOUT) <=86400 ){

			$this->_timeout=intval(WB_SECFORM_TIMEOUT);

		}

                if (defined ('WB_SECFORM_TOKENNAME') AND !$this->_validate_alalnum(WB_SECFORM_TOKENNAME)){

			$this->_tokenname=WB_SECFORM_TOKENNAME;

		}

                if (defined ('FINGERPRINT_WITH_IP_OCTETS') AND !$this->_is04(FINGERPRINT_WITH_IP_OCTETS)){

			$this->_useipblocks=FINGERPRINT_WITH_IP_OCTETS;

                }

		$this->_browser_fingerprint   = $this->_browser_fingerprint(true);

		$this->_fingerprint   = $this->_generate_fingerprint();

		$this->_serverdata    = $this->_generate_serverdata();

		$secret .= $this->_secret.$this->_serverdata.session_id();

		if ($this->_usefingerprint){$secret.= $this->_browser_fingerprint;}

	return $secret;

	}

	{

	// server depending values

 		$fingerprint  = $this->_generate_serverdata();

	// client depending values

		$fingerprint .= ( isset($_SERVER['HTTP_USER_AGENT']) ) ? $_SERVER['HTTP_USER_AGENT'] : '17';

		$usedOctets = ( defined('FINGERPRINT_WITH_IP_OCTETS') ) ? intval(defined('FINGERPRINT_WITH_IP_OCTETS')) : 0;

	return  $serverdata;

	}

        final protected function createFTAN(){}

	/*

	*

	* @requirements: an active session must be available

	* @description: IDKEY can handle string/numeric/array - vars. Each key is a

	*/

		}

		return $key;

	}

	* @description: each IDKEY can be checked only once. Unused Keys stay in list until the

	*               session is destroyed.

	*/

	{

		$return_value = $default; // set returnvalue to default

		switch( strtoupper($request) )

		{

			default:

				$key = $fieldname;

		}

				if( preg_match('/.*(?<!\{).*(\d:\{.*;\}).*(?!\}).*/', $return_value) )

				{ // if value is a serialized array, then deserialize it

					$return_value = unserialize($return_value);

				}

			}

		}

		return $return_value;

	}

	/* @access public

	* @return void

	*

	## all are Copyright Norbert Heimsath, heimsath.org

	## released under GPLv3  http://www.gnu.org/licenses/gpl.html

 	private function _validate_alalnum($input){

		if (preg_match('/^[a-zA-Z][0-9a-zA-Z]+$/u', $input))

			{return false;}

	return "The given input is not an alphanumeric string.";

 	private function _is04($input){

	# integer value between 0-4

		if (preg_match('/^[0-4]$/', $input)) {return false;}

	return "The given input is not an alphanumeric string.";

	private function _getip($ipblocks=4){

	*/

		$ip    	=   ""; //Ip address result

		$cutip	=   ""; //Ip address cut to limit

		# it sends us the "HTTP_X_FORWARDED_FOR" Header. Sometimes there is more than one Proxy.

		# !!!!!! THIS PART WAS NEVER TESTED BECAUSE I ONLY GOT A DIRECT INTERNET CONNECTION !!!!!!

		# long2ip(ip2long($lastip)) makes sure we got nothing else than an ip into our script ;-)

			$lastip = array_pop($iplist);

			$ip.= long2ip(ip2long($lastip));

		}

		/* If theres no other supported info we just use REMOTE_ADDR

		If we have a fiendly proxy supporting  HTTP_X_FORWARDED_FOR its ok to use the full address.

		*/

		{

			$ip = long2ip(ip2long($_SERVER['REMOTE_ADDR']));

			# ipblocks used here defines how many blocks of the ip adress are checked xxx.xxx.xxx.xxx

			$blocks = explode('.', $ip);

			for ($i=0; $i<$ipblocks; $i++){

				}

			$ip=substr($cutip, 0, -1);

		}

	return $ip;

	}

	private function _browser_fingerprint($encode=true,$fpsalt="My Fingerprint: "){

	/*

	Creates a basic Browser Fingerprint for securing the session and forms.

	*/

		$fingerprint=$fpsalt;

		if (isset($_SERVER['HTTP_USER_AGENT'])){ $fingerprint .= $_SERVER['HTTP_USER_AGENT'];}

		if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])){ $fingerprint .= $_SERVER['HTTP_ACCEPT_LANGUAGE'];}

		if (isset($_SERVER['HTTP_ACCEPT_ENCODING'])){ $fingerprint .= $_SERVER['HTTP_ACCEPT_ENCODING'];}

		if (isset($_SERVER['HTTP_ACCEPT_CHARSET'])){ $fingerprint .= $_SERVER['HTTP_ACCEPT_CHARSET'];}

		$fingerprint.= $this->_getip($this->_useipblocks);

		if ($encode){$fingerprint=md5($fingerprint);}

	return $fingerprint;

	}

	##

	## additional Functions END

	##