adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-19 11:06:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing expiration conditions on CSRF tokens.

Browse source
This commit is contained in:
mark_story 2010-10-02 18:27:39 -04:00
parent 7f7c202f35
commit d83c51cde9
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cake/libs/controller/components/security.php
View file

@ -719,9 +719,9 @@ class SecurityComponent extends Component {
* @return An array of nonce => expires. * @return An array of nonce => expires.
*/ */
protected function _expireTokens($tokens) { protected function _expireTokens($tokens) {
$tokenExpiryTime = strtotime($this->csrfExpires); $now = time();
foreach ($tokens as $nonce => $expires) { foreach ($tokens as $nonce => $expires) {
if ($expires < $tokenExpiryTime) { if ($expires < $now) {
unset($tokens[$nonce]); unset($tokens[$nonce]);
} }
} }

5
cake/tests/cases/libs/controller/components/security.test.php
View file

@ -1302,12 +1302,15 @@ DIGEST;
$this->Security->csrfExpires = '+10 minutes'; $this->Security->csrfExpires = '+10 minutes';
$this->Security->Session->write('_Token.csrfTokens', array( $this->Security->Session->write('_Token.csrfTokens', array(
'valid' => strtotime('+30 minutes'),
'poof' => strtotime('-11 minutes'), 'poof' => strtotime('-11 minutes'),
'dust' => strtotime('-20 minutes') 'dust' => strtotime('-20 minutes')
)); ));
$this->Security->startup($this->Controller); $this->Security->startup($this->Controller);
$tokens = $this->Security->Session->read('_Token.csrfTokens'); $tokens = $this->Security->Session->read('_Token.csrfTokens');
$this->assertEquals(1, count($tokens), 'Too many tokens left behind'); $this->assertEquals(2, count($tokens), 'Too many tokens left behind');
$this->assertNotEmpty('valid', $tokens, 'Valid token was removed.');
} }
/** /**