bouffeatulm/inc/CSRF.inc.php

32 lines
903 B
PHP
Raw Normal View History

<?php
// Generates a token against CSRF
2013-08-26 09:52:04 +02:00
// ==============================
function generate_token($name = '')
{
2013-08-26 09:52:04 +02:00
if(session_id() == '')
session_start();
$token = uniqid(rand(), true);
2013-08-26 09:52:04 +02:00
$_SESSION[$name.'_token'] = $token;
$_SESSION[$name.'_token_time'] = time();
2013-08-26 09:52:04 +02:00
return $token;
}
// Checks that the anti-CSRF token is correct
2013-08-26 09:52:04 +02:00
// ==========================================
function check_token($time, $name = '')
{
2013-08-26 09:52:04 +02:00
if(session_id() == '')
session_start();
if(isset($_SESSION[$name.'_token']) && isset($_SESSION[$name.'_token_time']) && isset($_POST['token'])) {
if($_SESSION[$name.'_token'] == $_POST['token']) {
if($_SESSION[$name.'_token_time'] >= (time() - (int) $time))
return true;
2013-08-26 09:52:04 +02:00
}
}
return false;
}