Nonce.php — Matomo Analytics – Powerful, Privacy-First Insights for WordPress 5.0.7

matomo / app / core / Nonce.php

matomo / app / core Last commit date

API 2 years ago Access 2 years ago Application 2 years ago Archive 2 years ago ArchiveProcessor 2 years ago Archiver 2 years ago AssetManager 2 years ago Auth 2 years ago Category 2 years ago Changes 2 years ago CliMulti 2 years ago Columns 2 years ago Concurrency 2 years ago Config 2 years ago Container 2 years ago CronArchive 2 years ago DataAccess 2 years ago DataFiles 2 years ago DataTable 2 years ago Db 2 years ago DeviceDetector 2 years ago Email 2 years ago Exception 2 years ago Http 2 years ago Intl 2 years ago Log 2 years ago Mail 2 years ago Measurable 2 years ago Menu 2 years ago Metrics 2 years ago Notification 2 years ago Period 2 years ago Plugin 2 years ago ProfessionalServices 2 years ago Report 2 years ago ReportRenderer 2 years ago Scheduler 2 years ago Segment 2 years ago Session 2 years ago Settings 2 years ago Tracker 2 years ago Translation 2 years ago Twig 2 years ago UpdateCheck 2 years ago Updater 2 years ago Updates 2 years ago Validators 2 years ago View 2 years ago ViewDataTable 2 years ago Visualization 2 years ago Widget 2 years ago .htaccess 2 years ago Access.php 2 years ago Archive.php 2 years ago ArchiveProcessor.php 2 years ago AssetManager.php 2 years ago Auth.php 2 years ago AuthResult.php 2 years ago BaseFactory.php 2 years ago Cache.php 2 years ago CacheId.php 2 years ago CliMulti.php 2 years ago Common.php 2 years ago Config.php 2 years ago Console.php 2 years ago Context.php 2 years ago Cookie.php 2 years ago CronArchive.php 2 years ago DI.php 2 years ago DataArray.php 2 years ago DataTable.php 2 years ago Date.php 2 years ago Db.php 2 years ago DbHelper.php 2 years ago Development.php 2 years ago ErrorHandler.php 2 years ago EventDispatcher.php 2 years ago ExceptionHandler.php 2 years ago FileIntegrity.php 2 years ago Filechecks.php 2 years ago Filesystem.php 2 years ago FrontController.php 2 years ago Http.php 2 years ago IP.php 2 years ago Log.php 2 years ago LogDeleter.php 2 years ago Mail.php 2 years ago Metrics.php 2 years ago NoAccessException.php 2 years ago Nonce.php 2 years ago Notification.php 2 years ago NumberFormatter.php 2 years ago Option.php 2 years ago Period.php 2 years ago Piwik.php 2 years ago Plugin.php 2 years ago Profiler.php 2 years ago ProxyHeaders.php 2 years ago ProxyHttp.php 2 years ago QuickForm2.php 2 years ago RankingQuery.php 2 years ago ReportRenderer.php 2 years ago Request.php 2 years ago Segment.php 2 years ago Sequence.php 2 years ago Session.php 2 years ago SettingsPiwik.php 2 years ago SettingsServer.php 2 years ago Singleton.php 2 years ago Site.php 2 years ago SiteContentDetector.php 2 years ago SupportedBrowser.php 2 years ago TCPDF.php 2 years ago Theme.php 2 years ago Timer.php 2 years ago Tracker.php 2 years ago Twig.php 2 years ago Unzip.php 2 years ago UpdateCheck.php 2 years ago Updater.php 2 years ago UpdaterErrorException.php 2 years ago Updates.php 2 years ago Url.php 2 years ago UrlHelper.php 2 years ago Version.php 2 years ago View.php 2 years ago bootstrap.php 2 years ago dispatch.php 2 years ago testMinimumPhpVersion.php 2 years ago

Nonce.php

199 lines

1	<?php
2
3	/**
4	* Matomo - free/libre analytics platform
5	*
6	* @link https://matomo.org
7	* @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
8	*
9	*/
10	namespace Piwik;
11
12	use Piwik\Session\SessionNamespace;
13	/**
14	* Nonce class.
15	*
16	* A cryptographic nonce -- "number used only once" -- is often recommended as
17	* part of a robust defense against cross-site request forgery (CSRF/XSRF). This
18	* class provides static methods that create and manage nonce values.
19	*
20	* Nonces in Piwik are stored as a session variable and have a configurable expiration.
21	*
22	* Learn more about nonces [here](http://en.wikipedia.org/wiki/Cryptographic_nonce).
23	*
24	* @api
25	*/
26	class Nonce
27	{
28	/**
29	* Returns an existing nonce by ID. If none exists, a new nonce will be generated.
30	*
31	* @param string $id Unique id to avoid namespace conflicts, e.g., `'ModuleName.ActionName'`.
32	* @param int $ttl Optional time-to-live in seconds; default is 5 minutes. (ie, in 5 minutes,
33	* the nonce will no longer be valid).
34	* @return string
35	*/
36	public static function getNonce($id, $ttl = 600)
37	{
38	// save session-dependent nonce
39	$ns = new SessionNamespace($id);
40	$nonce = $ns->nonce;
41	// re-use an unexpired nonce (a small deviation from the "used only once" principle, so long as we do not reset the expiration)
42	// to handle browser pre-fetch or double fetch caused by some browser add-ons/extensions
43	if (empty($nonce)) {
44	// generate a new nonce
45	$nonce = md5(\Piwik\SettingsPiwik::getSalt() . time() . \Piwik\Common::generateUniqId());
46	$ns->nonce = $nonce;
47	}
48	// extend lifetime if nonce is requested again to prevent from early timeout if nonce is requested again
49	// a few seconds before timeout
50	$ns->setExpirationSeconds($ttl, 'nonce');
51	return $nonce;
52	}
53	/**
54	* Returns if a nonce is valid and comes from a valid request.
55	*
56	* A nonce is valid if it matches the current nonce and if the current nonce
57	* has not expired.
58	*
59	* The request is valid if the referrer is a local URL (see {@link Url::isLocalUrl()})
60	* and if the HTTP origin is valid (see {@link getAcceptableOrigins()}).
61	*
62	* @param string $id The nonce's unique ID. See {@link getNonce()}.
63	* @param string $cnonce Nonce sent from client.
64	* @param null\|string $allowedReferrerHost The allowed referrer host for the HTTP referrer URL.
65	* @return bool `true` if valid; `false` otherwise.
66	*/
67	public static function verifyNonce($id, $cnonce, $allowedReferrerHost = null)
68	{
69	// load error with message function.
70	$error = self::verifyNonceWithErrorMessage($id, $cnonce, $allowedReferrerHost);
71	return $error === "";
72	}
73	/**
74	* Returns an error message, if any of the individual checks fails.
75	*
76	* A nonce must match the current nonce and must not be expired.
77	*
78	* If a referrer is present, it must match $allowedReferrerHost. The exception is a referrer that resolves to local,
79	* which is allowed if $allowedReferrerHost is empty.
80	* If a referrer is not present, then $allowedReferrerHost is ignored.
81	*
82	* The HTTP origin must be valid (see {@link getAcceptableOrigins()}).
83	*
84	* @param string $id The nonce's unique ID. See {@link getNonce()}.
85	* @param string $cnonce Nonce sent from client.
86	* @param string\|null $allowedReferrerHost The allowed referrer for the HTTP referrer URL. See method description.
87	* @return string if empty is valid otherwise return error message
88	*/
89	public static function verifyNonceWithErrorMessage($id, $cnonce, $allowedReferrerHost = null)
90	{
91	$ns = new SessionNamespace($id);
92	$nonce = $ns->nonce;
93	$additionalErrors = '';
94	// The Session cookie is set to a secure cookie, when SSL is mis-configured, it can cause the PHP session cookie ID to change on each page view.
95	// Indicate to user how to solve this particular use case by forcing secure connections.
96	if (\Piwik\Url::isSecureConnectionAssumedByPiwikButNotForcedYet()) {
97	$additionalErrors = '<br/><br/>' . \Piwik\Piwik::translate('Login_InvalidNonceSSLMisconfigured', array('<a target="_blank" rel="noreferrer noopener" href="' . \Piwik\Url::addCampaignParametersToMatomoLink('https://matomo.org/faq/how-to/faq_91/') . '">', '</a>', 'config/config.ini.php', '<pre>force_ssl=1</pre>', '<pre>[General]</pre>'));
98	}
99	// validate token
100	if (empty($cnonce) \|\| $cnonce !== $nonce) {
101	return \Piwik\Piwik::translate('Login_InvalidNonceToken');
102	}
103	// Validate referrer if present
104	$referrer = \Piwik\Url::getReferrer();
105	if (!empty($referrer)) {
106	// Allow the instance host by default, if no allowedReferrerHost is specified.
107	if (empty($allowedReferrerHost) && !\Piwik\Url::isLocalUrl($referrer)) {
108	return \Piwik\Piwik::translate('Login_InvalidNonceReferrer', array('<a target="_blank" rel="noreferrer noopener" href="' . \Piwik\Url::addCampaignParametersToMatomoLink('https://matomo.org/faq/how-to-install/faq_98') . '">', '</a>')) . $additionalErrors;
109	}
110	// Test that referrer matches what is allowed.
111	if (!empty($allowedReferrerHost) && !self::isReferrerHostValid($referrer, $allowedReferrerHost)) {
112	return \Piwik\Piwik::translate('Login_InvalidNonceUnexpectedReferrer') . $additionalErrors;
113	}
114	}
115	// validate origin
116	$origin = self::getOrigin();
117	if (!empty($origin) && ($origin == 'null' \|\| !in_array($origin, self::getAcceptableOrigins()))) {
118	return \Piwik\Piwik::translate('Login_InvalidNonceOrigin') . $additionalErrors;
119	}
120	return '';
121	}
122	// public for tests
123	public static function isReferrerHostValid($referrer, $allowedReferrerHost)
124	{
125	if (empty($referrer)) {
126	return false;
127	}
128	$referrerHost = \Piwik\Url::getHostFromUrl($referrer);
129	return preg_match('/(^\|\\.)' . preg_quote($allowedReferrerHost) . '$/i', $referrerHost);
130	}
131	/**
132	* Force expiration of the current nonce.
133	*
134	* @param string $id The unique nonce ID.
135	*/
136	public static function discardNonce($id)
137	{
138	$ns = new SessionNamespace($id);
139	$ns->unsetAll();
140	}
141	/**
142	* Returns the Origin HTTP header or `false` if not found.
143	*
144	* @return string\|bool
145	*/
146	public static function getOrigin()
147	{
148	if (!empty($_SERVER['HTTP_ORIGIN'])) {
149	return $_SERVER['HTTP_ORIGIN'];
150	}
151	return false;
152	}
153	/**
154	* Returns a list acceptable values for the HTTP Origin header.
155	*
156	* @return array
157	*/
158	public static function getAcceptableOrigins()
159	{
160	$host = \Piwik\Url::getCurrentHost(null);
161	if (empty($host)) {
162	return array();
163	}
164	// parse host:port
165	if (preg_match('/^([^:]+):([0-9]+)$/D', $host, $matches)) {
166	$host = $matches[1];
167	$port = $matches[2];
168	$origins = array('http://' . $host, 'https://' . $host);
169	if ($port != 443) {
170	$origins[] = 'http://' . $host . ':' . $port;
171	}
172	$origins[] = 'https://' . $host . ':' . $port;
173	} elseif (\Piwik\Config::getInstance()->General['force_ssl']) {
174	$origins = array('https://' . $host, 'https://' . $host . ':443');
175	} else {
176	$origins = array('http://' . $host, 'https://' . $host, 'http://' . $host . ':80', 'https://' . $host . ':443');
177	}
178	return $origins;
179	}
180	/**
181	* Verifies and discards a nonce.
182	*
183	* @param string $nonceName The nonce's unique ID. See {@link getNonce()}.
184	* @param string\|null $nonce The nonce from the client. If `null`, the value from the
185	* nonce query parameter is used.
186	* @throws \Exception if the nonce is invalid. See {@link verifyNonce()}.
187	*/
188	public static function checkNonce($nonceName, $nonce = null, $allowedReferrerHost = null)
189	{
190	if ($nonce === null) {
191	$nonce = \Piwik\Common::getRequestVar('nonce', null, 'string');
192	}
193	if (!self::verifyNonce($nonceName, $nonce, $allowedReferrerHost)) {
194	throw new \Exception(\Piwik\Piwik::translate('General_ExceptionSecurityCheckFailed'));
195	}
196	self::discardNonce($nonceName);
197	}
198	}
199