mirror of
https://github.com/kamilwylegala/cakephp2-php8.git
synced 2024-11-15 03:18:26 +00:00
32df3156a7
it's a lot easier for adding new translations to think: is it for the end user? use 'cake' as the domain is it for the developer use 'cake_dev' as the domain is it for the console use 'cake_console' as the domain also neatly avoids the "this message is an error, and it's in cake_developer, why?" - question (because cake_error was intended for anything which is used in trigger_error/exceptions, not a variable named $error
157 lines
3.5 KiB
PHP
157 lines
3.5 KiB
PHP
<?php
|
|
/**
|
|
* Core Security
|
|
*
|
|
* PHP 5
|
|
*
|
|
* CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
|
|
* Copyright 2005-2010, Cake Software Foundation, Inc. (http://cakefoundation.org)
|
|
*
|
|
* Licensed under The MIT License
|
|
* Redistributions of files must retain the above copyright notice.
|
|
*
|
|
* @copyright Copyright 2005-2010, Cake Software Foundation, Inc. (http://cakefoundation.org)
|
|
* @link http://cakephp.org CakePHP(tm) Project
|
|
* @package cake.libs
|
|
* @since CakePHP(tm) v .0.10.0.1233
|
|
* @license MIT License (http://www.opensource.org/licenses/mit-license.php)
|
|
*/
|
|
|
|
App::uses('String', 'Utility');
|
|
|
|
/**
|
|
* Security Library contains utility methods related to security
|
|
*
|
|
* @package cake.libs
|
|
*/
|
|
class Security {
|
|
|
|
/**
|
|
* Default hash method
|
|
*
|
|
* @var string
|
|
*/
|
|
public static $hashType = null;
|
|
|
|
/**
|
|
* Get allowed minutes of inactivity based on security level.
|
|
*
|
|
* @return integer Allowed inactivity in minutes
|
|
*/
|
|
public static function inactiveMins() {
|
|
switch (Configure::read('Security.level')) {
|
|
case 'high':
|
|
return 10;
|
|
break;
|
|
case 'medium':
|
|
return 100;
|
|
break;
|
|
case 'low':
|
|
default:
|
|
return 300;
|
|
break;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Generate authorization hash.
|
|
*
|
|
* @return string Hash
|
|
*/
|
|
public static function generateAuthKey() {
|
|
return Security::hash(String::uuid());
|
|
}
|
|
|
|
/**
|
|
* Validate authorization hash.
|
|
*
|
|
* @param string $authKey Authorization hash
|
|
* @return boolean Success
|
|
* @todo Complete implementation
|
|
*/
|
|
function validateAuthKey($authKey) {
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Create a hash from string using given method.
|
|
* Fallback on next available method.
|
|
*
|
|
* @param string $string String to hash
|
|
* @param string $type Method to use (sha1/sha256/md5)
|
|
* @param boolean $salt If true, automatically appends the application's salt
|
|
* value to $string (Security.salt)
|
|
* @return string Hash
|
|
*/
|
|
public static function hash($string, $type = null, $salt = false) {
|
|
if ($salt) {
|
|
if (is_string($salt)) {
|
|
$string = $salt . $string;
|
|
} else {
|
|
$string = Configure::read('Security.salt') . $string;
|
|
}
|
|
}
|
|
|
|
if (empty($type)) {
|
|
$type = self::$hashType;
|
|
}
|
|
$type = strtolower($type);
|
|
|
|
if ($type == 'sha1' || $type == null) {
|
|
if (function_exists('sha1')) {
|
|
$return = sha1($string);
|
|
return $return;
|
|
}
|
|
$type = 'sha256';
|
|
}
|
|
|
|
if ($type == 'sha256' && function_exists('mhash')) {
|
|
return bin2hex(mhash(MHASH_SHA256, $string));
|
|
}
|
|
|
|
if (function_exists('hash')) {
|
|
return hash($type, $string);
|
|
}
|
|
return md5($string);
|
|
}
|
|
|
|
/**
|
|
* Sets the default hash method for the Security object. This affects all objects using
|
|
* Security::hash().
|
|
*
|
|
* @param string $hash Method to use (sha1/sha256/md5)
|
|
* @return void
|
|
* @see Security::hash()
|
|
*/
|
|
public static function setHash($hash) {
|
|
self::$hashType = $hash;
|
|
}
|
|
|
|
/**
|
|
* Encrypts/Decrypts a text using the given key.
|
|
*
|
|
* @param string $text Encrypted string to decrypt, normal string to encrypt
|
|
* @param string $key Key to use
|
|
* @return string Encrypted/Decrypted string
|
|
*/
|
|
public static function cipher($text, $key) {
|
|
if (empty($key)) {
|
|
trigger_error(__d('cake_dev', 'You cannot use an empty key for Security::cipher()'), E_USER_WARNING);
|
|
return '';
|
|
}
|
|
|
|
srand(Configure::read('Security.cipherSeed'));
|
|
$out = '';
|
|
$keyLength = strlen($key);
|
|
for ($i = 0, $textLength = strlen($text); $i < $textLength; $i++) {
|
|
$j = ord(substr($key, $i % $keyLength, 1));
|
|
while ($j--) {
|
|
rand(0, 255);
|
|
}
|
|
$mask = rand(0, 255);
|
|
$out .= chr(ord(substr($text, $i, 1)) ^ $mask);
|
|
}
|
|
srand();
|
|
return $out;
|
|
}
|
|
}
|