| 1 |
<?php if (! defined('ABSPATH')) exit; // Exit if accessed directly |
| 2 |
class HC3_Csrf implements HC3_ICsrf |
| 3 |
{ |
| 4 |
protected $actionName = 'post'; |
| 5 |
protected $tokenName = 'hc-csrf'; |
| 6 |
|
| 7 |
public function checkInput() |
| 8 |
{ |
| 9 |
unset( $_POST[$this->tokenName] ); |
| 10 |
return $this; |
| 11 |
|
| 12 |
if( ! isset($_POST[$this->tokenName])){ |
| 13 |
// echo "want token name " . $this->tokenName . '<br>'; |
| 14 |
// _print_r( $_POST ); |
| 15 |
echo 'csrf: no token'; |
| 16 |
exit; |
| 17 |
} |
| 18 |
|
| 19 |
$nonce = $_POST[$this->tokenName]; |
| 20 |
if( ! wp_verify_nonce( $nonce, $this->actionName ) ){ |
| 21 |
echo 'csrf: token mismatch'; |
| 22 |
exit; |
| 23 |
} |
| 24 |
|
| 25 |
// We kill this since we're done and we don't want to polute the _POST array |
| 26 |
unset( $_POST[$this->tokenName] ); |
| 27 |
return $this; |
| 28 |
} |
| 29 |
|
| 30 |
public function prepareOutput( $output ) |
| 31 |
{ |
| 32 |
// $hidden = wp_nonce_field( $this->actionName, $this->tokenName, TRUE, FALSE ); |
| 33 |
|
| 34 |
$nonceVal = wp_create_nonce( 'shiftcontroller' ); |
| 35 |
$hidden = '<input type="hidden" name="hc_nonce" value="' . $nonceVal . '"/>'; |
| 36 |
|
| 37 |
$output = str_replace('</form>', $hidden . '</form>', $output); |
| 38 |
return $output; |
| 39 |
} |
| 40 |
} |
