├── .gitignore
├── composer.json
├── composer.lock
├── example
    ├── without-composer
    │   ├── get-method.php
    │   ├── post-method.php
    │   ├── all-method.php
    │   └── lib
    │   │   └── csrfhandler.php
    └── with-composer
    │   ├── get-method.php
    │   ├── post-method.php
    │   └── all-method.php
├── LICENSE
├── README.md
└── src
    └── csrfhandler
        └── csrf.php


/.gitignore:
--------------------------------------------------------------------------------
1 | /vendor/
2 | .idea/
3 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name": "banujan6/csrf-handler",
 3 | 	"description": "CSRF token validator library for PHP",
 4 |     "license": "MIT",
 5 |     "authors": [
 6 |         {
 7 |             "name": "Banujan Balendrakumar",
 8 |             "email": "bbalendrakumar@gmail.com"
 9 |         }
10 |     ],
11 | 	"minimum-stability": "dev",
12 | 	"require": {
13 |         "php": ">=5.5.0"
14 |     },
15 |     "autoload": {
16 |         "psr-0": {
17 |             "csrfhandler": "src/"
18 |         }
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/composer.lock:
--------------------------------------------------------------------------------
 1 | {
 2 |     "_readme": [
 3 |         "This file locks the dependencies of your project to a known state",
 4 |         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
 5 |         "This file is @generated automatically"
 6 |     ],
 7 |     "content-hash": "91e16d99386b1fd022f540d437a0b7d9",
 8 |     "packages": [],
 9 |     "packages-dev": [],
10 |     "aliases": [],
11 |     "minimum-stability": "dev",
12 |     "stability-flags": [],
13 |     "prefer-stable": false,
14 |     "prefer-lowest": false,
15 |     "platform": {
16 |         "php": ">=5.5.0"
17 |     },
18 |     "platform-dev": []
19 | }
20 | 


--------------------------------------------------------------------------------
/example/without-composer/get-method.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 	//importing csrf handler
 3 | 	require_once('lib//csrfhandler.php');
 4 | 	use csrfhandler\csrf as csrf;
 5 | 	
 6 | 	//check for only get requests
 7 | 	$isValid = csrf::get();
 8 | 	
 9 | 	if($isValid) {
10 | 		
11 | 		echo "Valid Token"; //show text when valid
12 | 		
13 | 	} else {
14 | 		
15 | 		echo "Invalid Token"; //show text when invalid
16 | 		
17 | 	}
18 | ?>
19 | 
20 | <div>
21 | 	<!-- Simple form to make GET requests -->
22 | 	<form method="get">
23 | 			yourname : <input type="text">
24 | 			<!-- inserting csrf token field -->
25 | 			<p>
26 | 				Refrest or Use developer tool to change the token in hidden field and test.
27 | 			</p>
28 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
29 | 			<input type="submit" value="Submit">
30 | 	</form>
31 | 	
32 | </div>
33 | 
34 | 


--------------------------------------------------------------------------------
/example/without-composer/post-method.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 	//importing csrf handler
 3 | 	require_once('lib//csrfhandler.php');
 4 | 	use csrfhandler\csrf as csrf;
 5 | 	
 6 | 	//check for only post requests
 7 | 	$isValid = csrf::post();
 8 | 	
 9 | 	if($isValid) {
10 | 		
11 | 		echo "Valid Token"; //show text when valid
12 | 		
13 | 	} else {
14 | 		
15 | 		echo "Invalid Token"; //show text when invalid
16 | 		
17 | 	}
18 | ?>
19 | 
20 | <div>
21 | 	<!-- Simple form to make POST requests -->
22 | 	<form method="post">
23 | 			yourname : <input type="text">
24 | 			<p>
25 | 				Refrest or Use developer tool to change the token in hidden field and test.
26 | 			</p>
27 | 			<!-- inserting csrf token field -->
28 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
29 | 			<input type="submit" value="Submit">
30 | 	</form>
31 | 	
32 | </div>
33 | 
34 | 


--------------------------------------------------------------------------------
/example/with-composer/get-method.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 	//importing csrf handler
 3 | 	require_once __DIR__ . '/../../vendor/autoload.php';
 4 | 	use csrfhandler\csrf as csrf;
 5 | 	
 6 | 	//check for only get requests
 7 | 	$isValid = csrf::get();
 8 | 	
 9 | 	if($isValid) {
10 | 		
11 | 		echo "Valid Token"; //show text when valid
12 | 		
13 | 	} else {
14 | 		
15 | 		echo "Invalid Token"; //show text when invalid
16 | 		
17 | 	}
18 | ?>
19 | 
20 | <div>
21 | 	<!-- Simple form to make GET requests -->
22 | 	<form method="get">
23 | 			yourname : <input type="text">
24 | 			<!-- inserting csrf token field -->
25 | 			<p>
26 | 				Refrest or Use developer tool to change the token in hidden field and test.
27 | 			</p>
28 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
29 | 			<input type="submit" value="Submit">
30 | 	</form>
31 | 	
32 | </div>
33 | 
34 | 


--------------------------------------------------------------------------------
/example/with-composer/post-method.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 	//importing csrf handler
 3 | 	require_once __DIR__ . '/../../vendor/autoload.php';
 4 | 	use csrfhandler\csrf as csrf;
 5 | 	
 6 | 	//check for only post requests
 7 | 	$isValid = csrf::post();
 8 | 	
 9 | 	if($isValid) {
10 | 		
11 | 		echo "Valid Token"; //show text when valid
12 | 		
13 | 	} else {
14 | 		
15 | 		echo "Invalid Token"; //show text when invalid
16 | 		
17 | 	}
18 | ?>
19 | 
20 | <div>
21 | 	<!-- Simple form to make POST requests -->
22 | 	<form method="post">
23 | 			yourname : <input type="text">
24 | 			<p>
25 | 				Refrest or Use developer tool to change the token in hidden field and test.
26 | 			</p>
27 | 			<!-- inserting csrf token field -->
28 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
29 | 			<input type="submit" value="Submit">
30 | 	</form>
31 | 	
32 | </div>
33 | 
34 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2019 Banujan Balendrakumar
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/example/without-composer/all-method.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 	//importing csrf handler
 3 | 	require_once('lib//csrfhandler.php');
 4 | 	use csrfhandler\csrf as csrf;
 5 | 	
 6 | 	//check for only get & post requests
 7 | 	$isValid = csrf::all();
 8 | 	
 9 | 	if($isValid) {
10 | 		
11 | 		echo "Valid Token"; //show text when valid
12 | 		
13 | 	} else {
14 | 		
15 | 		echo "Invalid Token"; //show text when invalid
16 | 		
17 | 	}
18 | ?>
19 | <br><br>
20 | <h3>GET form</h3>
21 | <div>
22 | 	<!-- Simple form to make GET requests -->
23 | 	<form method="get">
24 | 			yourname : <input type="text">
25 | 			<!-- inserting csrf token field -->
26 | 			<p>
27 | 				Refrest or Use developer tool to change the token in hidden field and test.
28 | 			</p>
29 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
30 | 			<input type="submit" value="Submit">
31 | 	</form>
32 | 	
33 | </div>
34 | 
35 | <br><br>
36 | 
37 | <h3>POST form</h3>
38 | <div>
39 | 	<!-- Simple form to make GET requests -->
40 | 	<form method="post">
41 | 			yourname : <input type="text">
42 | 			<!-- inserting csrf token field -->
43 | 			<p>
44 | 				Refrest or Use developer tool to change the token in hidden field and test.
45 | 			</p>
46 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
47 | 			<input type="submit" value="Submit">
48 | 	</form>
49 | 	
50 | </div>
51 | 
52 | 


--------------------------------------------------------------------------------
/example/with-composer/all-method.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 	//importing csrf handler
 3 | 	require_once __DIR__ . '/../../vendor/autoload.php';
 4 | 
 5 | 	use csrfhandler\csrf as csrf;
 6 | 	
 7 | 	//check for only get & post requests
 8 | 	$isValid = csrf::all();
 9 | 	
10 | 	if($isValid) {
11 | 		
12 | 		echo "Valid Token"; //show text when valid
13 | 		
14 | 	} else {
15 | 		
16 | 		echo "Invalid Token"; //show text when invalid
17 | 		
18 | 	}
19 | ?>
20 | <br><br>
21 | <h3>GET form</h3>
22 | <div>
23 | 	<!-- Simple form to make GET requests -->
24 | 	<form method="get">
25 | 			yourname : <input type="text">
26 | 			<!-- inserting csrf token field -->
27 | 			<p>
28 | 				Refrest or Use developer tool to change the token in hidden field and test.
29 | 			</p>
30 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
31 | 			<input type="submit" value="Submit">
32 | 	</form>
33 | 	
34 | </div>
35 | 
36 | <br><br>
37 | 
38 | <h3>POST form</h3>
39 | <div>
40 | 	<!-- Simple form to make GET requests -->
41 | 	<form method="post">
42 | 			yourname : <input type="text">
43 | 			<!-- inserting csrf token field -->
44 | 			<p>
45 | 				Refrest or Use developer tool to change the token in hidden field and test.
46 | 			</p>
47 | 			<input type="hidden" name="_token" value="<?php echo csrf::token()?>">
48 | 			<input type="submit" value="Submit">
49 | 	</form>
50 | 	
51 | </div>
52 | 
53 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # [DEPRECATED] CSRF-Handler ![version](https://img.shields.io/badge/Version-2.0.1-green.svg) ![stars](https://img.shields.io/github/stars/banujan6/CSRF-handler.svg) ![commit](https://img.shields.io/badge/Commit-Verified-brightgreen.svg)
  2 | <b>CSRF protection</b> class file for <b>PHP</b>.<br><br>
  3 | <b>Bye Bye, Version 1.0!</b><br>
  4 | We released version 2 with better implementation. :)
  5 | 
  6 | # Please Note: We no longer maintain this project. Please Consider using PHP Frameworks for better built-in security.
  7 | 
  8 | # Functions
  9 | 
 10 | | Function  | Description |
 11 | | ------------- | ------------- |
 12 | | get()  | Validate CSRF only for GET requests  |
 13 | | post()   | Validate CSRF only for POST requests   |
 14 | | all()   | Validate CSRF for GET & POST requests   |
 15 | | token()   | Generate CSRF Token   |
 16 | | flushToken()  | Remove all tokens |
 17 | 
 18 | 
 19 | # Installation
 20 | 
 21 | <br>
 22 | <i><b>Via Composer</b></i>
 23 | <br>
 24 | <p>
 25 | 	Require the package.
 26 | </p>
 27 | 
 28 | ```php
 29 | 	composer require banujan6/csrf-handler
 30 | ```
 31 | <br>
 32 | <p>Use namespace & class.</p>
 33 | 
 34 | ```php
 35 | 	<?php
 36 | 		//If you are using any frameworks, It will load autoload.php automatically. So you don't need.
 37 | 		require_once __DIR__ . '/../../vendor/autoload.php';
 38 | 		use csrfhandler\csrf as csrf;
 39 | 	?>
 40 | ```
 41 | 
 42 | <br>
 43 | <br>
 44 | <i><b>Including File</b></i>
 45 | <br><br>
 46 | <p>Download the <b>csrf.php</b> file in directory <b>src</b>. Then include it in your PHP file.</p>
 47 | <br><br>
 48 | 
 49 | ```php
 50 | <?php 
 51 |   require_once("path/csrf.php");
 52 |   use csrfhandler\csrf as csrf;
 53 | ?>
 54 | ```
 55 | 
 56 | # Usages
 57 | 
 58 | <p>
 59 |  This <b>CSRF-Handler</b> will look for a <i>form-data</i> / <i>url-parameter</i> called <b>_token</b>. To verify the request, <i>POST</i> request need to have a <b>_token</b> in <i>form-data</i>. And <i>GET</i> request need to have a <b>_token</b> in <i>url-parameter</i>.  
 60 | </p>
 61 | 
 62 | 
 63 | ### Generating Token
 64 | 
 65 | ```php
 66 | <form>
 67 |   <input type="hidden" name="_token" value="<?php echo csrf::token(); ?>">
 68 | </form>
 69 | ```
 70 | 
 71 | ### Validating Request
 72 | 
 73 | <b>GET Request Only</b>
 74 | 
 75 | ```php
 76 |   $isValid = csrf::get(); // return TRUE or FALSE
 77 |   
 78 |   if ( $isValid ) {
 79 |   
 80 |     //Do something if valid
 81 |   
 82 |   } else {
 83 |   
 84 |     //Do something if not vaid
 85 |   
 86 |   }
 87 | ```
 88 | 
 89 | <b>POST Request Only</b>
 90 | 
 91 | ```php
 92 |   $isValid = csrf::post(); // return TRUE or FALSE
 93 |   
 94 |   if ( $isValid ) {
 95 |   
 96 |     //Do something if valid
 97 |   
 98 |   } else {
 99 |   
100 |     //Do something if not vaid
101 |   
102 |   }
103 | ```
104 | 
105 | <b>GET & POST Request</b>
106 | 
107 | ```php
108 |   $isValid = csrf::all(); // return TRUE or FALSE
109 |   
110 |   if ( $isValid ) {
111 |   
112 |     //Do something if valid
113 |   
114 |   } else {
115 |   
116 |     //Do something if not vaid
117 |   
118 |   }
119 | ```
120 | 
121 | 
122 | ### Clear All Active Tokens
123 | 
124 | ```php
125 |   csrf::flushToken(); // will destroy all active tokens
126 | ```
127 | 
128 | 
129 | # Examples
130 | 
131 | <p>
132 |   You can find basic examples in <b><i>example/</i></b> directory. 
133 |   </p>
134 |   
135 | # License
136 | 
137 | Licensed under MIT
138 | 


--------------------------------------------------------------------------------
/src/csrfhandler/csrf.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | /*
  3 | Name	: 	Simple CSRF protection class for Core-PHP (Non-Framework).
  4 | By		: 	Banujan Balendrakumar | https://github.com/banujan6
  5 | License	: 	Free & Open
  6 | Thanks	:	http://itman.in - getRealIpAddr();
  7 | */
  8 | namespace csrfhandler;
  9 | class csrf {
 10 | 
 11 |     private static function startSession()
 12 |     {
 13 |         if ( !isset($_SESSION) && session_status() === PHP_SESSION_NONE) {
 14 |             session_start();
 15 |         }
 16 | 
 17 |         if ( !isset($_SESSION['X-CSRF-TOKEN-LIST']) ) {
 18 |             $_SESSION['X-CSRF-TOKEN-LIST'] = null; // initializing the index if not exist only
 19 |         }
 20 |     }
 21 | 
 22 |     private static function randomToken()
 23 |     {
 24 | 
 25 |         $keySet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 26 | 
 27 |         for($i = 0; $i < 5; $i++){
 28 |             $keySet = str_shuffle($keySet);
 29 |         }
 30 | 
 31 |         $userAgent = (isset($_SERVER['HTTP_USER_AGENT'])) ? $_SERVER['HTTP_USER_AGENT'] : null;
 32 | 
 33 |         $clientIp = self::getRealIpAddr();
 34 | 
 35 |         if (phpversion() < 5.5)
 36 |         {
 37 |             $hashedToken = hash('sha256', base64_encode($keySet.$userAgent.$clientIp));
 38 |         }
 39 |         else
 40 |         {
 41 |             $hashedToken = base64_encode(password_hash(base64_encode($keySet.$userAgent.$clientIp), PASSWORD_BCRYPT));
 42 |         }
 43 | 
 44 |         self::setToken($hashedToken);
 45 | 
 46 |         return $hashedToken;
 47 | 
 48 |     }
 49 | 
 50 |     private static function getRealIpAddr()
 51 |     {
 52 |         if (!empty($_SERVER['HTTP_CLIENT_IP']))
 53 |         {
 54 |             $ip=$_SERVER['HTTP_CLIENT_IP'];
 55 |         }
 56 |         elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
 57 |         {
 58 |             $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
 59 |         }
 60 |         else
 61 |         {
 62 |             $ip=$_SERVER['REMOTE_ADDR'];
 63 |         }
 64 |         return $ip;
 65 |     }
 66 | 
 67 |     private static function setToken($token)
 68 |     {
 69 |         self::startSession();
 70 | 
 71 |         $tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);
 72 | 
 73 |         if (!is_array($tokenList))
 74 |         {
 75 |             $tokenList = array();
 76 |         }
 77 | 
 78 |         array_push($tokenList, $token);
 79 |         $_SESSION['X-CSRF-TOKEN-LIST'] = serialize($tokenList);
 80 |     }
 81 | 
 82 |     private static function checkToken($token)
 83 |     {
 84 |         self::startSession();
 85 | 
 86 |         $tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);
 87 |         if(is_array($tokenList) && in_array($token, $tokenList)){
 88 |             self::removeToken($token);
 89 |             return true;
 90 |         }else{
 91 |             return false;
 92 |         }
 93 |     }
 94 | 
 95 |     private static function removeToken($token)
 96 |     {
 97 |         self::startSession();
 98 |         $tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);
 99 |         $index = array_search($token, $tokenList);
100 |         unset($tokenList[$index]);
101 |         $_SESSION['X-CSRF-TOKEN-LIST'] = serialize($tokenList);
102 |     }
103 | 
104 |     private static function authToken($arrData)
105 |     {
106 |         if(!empty($arrData)){
107 | 
108 |             if($arrData["method"] !== $_SERVER["REQUEST_METHOD"] && $arrData["method"] !== "ALL") {
109 |                 return true;
110 |             }
111 | 
112 |             self::startSession();
113 | 
114 |             if(isset($arrData["token"]) && !empty($arrData["token"])){
115 |                 $token = $arrData["token"];
116 |             } else {
117 |                 return false;
118 |             }
119 | 
120 |             return self::checkToken($token);
121 | 
122 |         } else {
123 |             return false;
124 |         }
125 |     }
126 | 
127 |     public static function token()
128 |     {
129 |         return self::randomToken();
130 |     }
131 | 
132 |     public static function get()
133 |     {
134 |         return self::authToken(array(
135 |             "method" => "GET",
136 |             "token" => (isset($_GET['_token'])) ? $_GET['_token'] : null
137 |         ));
138 |     }
139 | 
140 |     public static function post()
141 |     {
142 |         return self::authToken(array(
143 |             "method" => "POST",
144 |             "token" => (isset($_POST['_token'])) ? $_POST['_token'] : null
145 |         ));
146 |     }
147 | 
148 |     public static function all()
149 |     {
150 |         if(isset($_POST['_token'])) {
151 |             return self::authToken(array(
152 |                 "method" => "ALL",
153 |                 "token" => $_POST['_token']
154 |             ));
155 |         } else if(isset($_GET['_token'])) {
156 |             return self::authToken(array(
157 |                 "method" => "ALL",
158 |                 "token" => $_GET['_token']
159 |             ));
160 |         } else {
161 |             return self::authToken(array(
162 |                 "method" => "ALL",
163 |                 "token" => null
164 |             ));
165 |         }
166 | 
167 |     }
168 | 
169 |     public static function flushToken()
170 |     {
171 |         self::startSession();
172 |         $_SESSION['X-CSRF-TOKEN-LIST'] = null;
173 |     }
174 | }
175 | 
176 | 


--------------------------------------------------------------------------------
/example/without-composer/lib/csrfhandler.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | /*
  3 | Name	: 	Simple CSRF protection class for Core-PHP (Non-Framework).
  4 | By		: 	Banujan Balendrakumar | https://github.com/banujan6
  5 | License	: 	Free & Open
  6 | Thanks	:	http://itman.in - getRealIpAddr();
  7 | */
  8 | namespace csrfhandler;
  9 | class csrf {
 10 | 
 11 |     private static function startSession()
 12 |     {
 13 |         if ( !isset($_SESSION) && session_status() === PHP_SESSION_NONE) {
 14 |             session_start();
 15 |         }
 16 | 
 17 |         if ( !isset($_SESSION['X-CSRF-TOKEN-LIST']) ) {
 18 |             $_SESSION['X-CSRF-TOKEN-LIST'] = null; // initializing the index if not exist only
 19 |         }
 20 |     }
 21 | 
 22 |     private static function randomToken()
 23 |     {
 24 | 
 25 |         $keySet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 26 | 
 27 |         for($i = 0; $i < 5; $i++){
 28 |             $keySet = str_shuffle($keySet);
 29 |         }
 30 | 
 31 |         $userAgent = (isset($_SERVER['HTTP_USER_AGENT'])) ? $_SERVER['HTTP_USER_AGENT'] : null;
 32 | 
 33 |         $clientIp = self::getRealIpAddr();
 34 | 
 35 |         if (phpversion() < 5.5)
 36 |         {
 37 |             $hashedToken = hash('sha256', base64_encode($keySet.$userAgent.$clientIp));
 38 |         }
 39 |         else
 40 |         {
 41 |             $hashedToken = base64_encode(password_hash(base64_encode($keySet.$userAgent.$clientIp), PASSWORD_BCRYPT));
 42 |         }
 43 | 
 44 |         self::setToken($hashedToken);
 45 | 
 46 |         return $hashedToken;
 47 | 
 48 |     }
 49 | 
 50 |     private static function getRealIpAddr()
 51 |     {
 52 |         if (!empty($_SERVER['HTTP_CLIENT_IP']))
 53 |         {
 54 |             $ip=$_SERVER['HTTP_CLIENT_IP'];
 55 |         }
 56 |         elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
 57 |         {
 58 |             $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
 59 |         }
 60 |         else
 61 |         {
 62 |             $ip=$_SERVER['REMOTE_ADDR'];
 63 |         }
 64 |         return $ip;
 65 |     }
 66 | 
 67 |     private static function setToken($token)
 68 |     {
 69 |         self::startSession();
 70 | 
 71 |         $tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);
 72 | 
 73 |         if (!is_array($tokenList))
 74 |         {
 75 |             $tokenList = array();
 76 |         }
 77 | 
 78 |         array_push($tokenList, $token);
 79 |         $_SESSION['X-CSRF-TOKEN-LIST'] = serialize($tokenList);
 80 |     }
 81 | 
 82 |     private static function checkToken($token)
 83 |     {
 84 |         self::startSession();
 85 | 
 86 |         $tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);
 87 |         if(is_array($tokenList) && in_array($token, $tokenList)){
 88 |             self::removeToken($token);
 89 |             return true;
 90 |         }else{
 91 |             return false;
 92 |         }
 93 |     }
 94 | 
 95 |     private static function removeToken($token)
 96 |     {
 97 |         self::startSession();
 98 |         $tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);
 99 |         $index = array_search($token, $tokenList);
100 |         unset($tokenList[$index]);
101 |         $_SESSION['X-CSRF-TOKEN-LIST'] = serialize($tokenList);
102 |     }
103 | 
104 |     private static function authToken($arrData)
105 |     {
106 |         if(!empty($arrData)){
107 | 
108 |             if($arrData["method"] !== $_SERVER["REQUEST_METHOD"] && $arrData["method"] !== "ALL") {
109 |                 return true;
110 |             }
111 | 
112 |             self::startSession();
113 | 
114 |             if(isset($arrData["token"]) && !empty($arrData["token"])){
115 |                 $token = $arrData["token"];
116 |             } else {
117 |                 return false;
118 |             }
119 | 
120 |             return self::checkToken($token);
121 | 
122 |         } else {
123 |             return false;
124 |         }
125 |     }
126 | 
127 |     public static function token()
128 |     {
129 |         return self::randomToken();
130 |     }
131 | 
132 |     public static function get()
133 |     {
134 |         return self::authToken(array(
135 |             "method" => "GET",
136 |             "token" => (isset($_GET['_token'])) ? $_GET['_token'] : null
137 |         ));
138 |     }
139 | 
140 |     public static function post()
141 |     {
142 |         return self::authToken(array(
143 |             "method" => "POST",
144 |             "token" => (isset($_POST['_token'])) ? $_POST['_token'] : null
145 |         ));
146 |     }
147 | 
148 |     public static function all()
149 |     {
150 |         if(isset($_POST['_token'])) {
151 |             return self::authToken(array(
152 |                 "method" => "ALL",
153 |                 "token" => $_POST['_token']
154 |             ));
155 |         } else if(isset($_GET['_token'])) {
156 |             return self::authToken(array(
157 |                 "method" => "ALL",
158 |                 "token" => $_GET['_token']
159 |             ));
160 |         } else {
161 |             return self::authToken(array(
162 |                 "method" => "ALL",
163 |                 "token" => null
164 |             ));
165 |         }
166 | 
167 |     }
168 | 
169 |     public static function flushToken()
170 |     {
171 |         self::startSession();
172 |         $_SESSION['X-CSRF-TOKEN-LIST'] = null;
173 |     }
174 | }
175 | 
176 | 


--------------------------------------------------------------------------------