File manager - Edit - /home/opticamezl/www/newok/plugins/user/token/src/Field/JoomlatokenField.php
Back
<?php /** * @package Joomla.Plugin * @subpackage User.token * * @copyright (C) 2020 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\Plugin\User\Token\Field; use Joomla\CMS\Factory; use Joomla\CMS\Form\Field\TextField; // phpcs:disable PSR1.Files.SideEffects \defined('_JEXEC') or die; // phpcs:enable PSR1.Files.SideEffects /** * Joomlatoken field class * * @since 4.0.0 */ class JoomlatokenField extends TextField { /** * Name of the layout being used to render the field * * @var string * @since 4.0.0 */ protected $layout = 'plugins.user.token.token'; /** * Method to attach a Form object to the field. * * @param \SimpleXMLElement $element The SimpleXMLElement object representing the `<field>` * tag for the form field object. * @param mixed $value The form field value to validate. * @param string $group The field name group control value. This acts as an * array container for the field. For example if the * field has name="foo" and the group value is set to * "bar" then the full field name would end up being * "bar[foo]". * * @return boolean True on success. * * @see FormField::setup() * @since 4.0.0 */ public function setup(\SimpleXMLElement $element, $value, $group = null) { $ret = parent::setup($element, $value, $group); /** * Security and privacy precaution: do not display the token field when the user being * edited is not the same as the logged in user. Tokens are conceptually a combination of * a username and password, therefore they should be treated in the same mode of * confidentiality and privacy as passwords i.e. you can reset them for other users but NOT * be able to see them, thus preventing impersonation attacks by a malicious administrator. */ $userId = $this->form->getData()->get('id'); if ($userId != Factory::getUser()->id) { $this->hidden = true; } return $ret; } /** * Method to get the field input markup. * * @return string The field input markup. * * @since 4.0.0 */ protected function getInput() { // Do not display the token field when the user being edited is not the same as the logged in user if ($this->hidden) { return ''; } return parent::getInput(); } /** * Returns the token formatted suitably for the user to copy. * * @param string $tokenSeed The token seed data stored in the database * * @return string * @since 4.0.0 */ private function getTokenForDisplay(string $tokenSeed): string { if (empty($tokenSeed)) { return ''; } $algorithm = $this->getAttribute('algo', 'sha256'); try { $siteSecret = Factory::getApplication()->get('secret'); } catch (\Exception $e) { $siteSecret = ''; } // NO site secret? You monster! if (empty($siteSecret)) { return ''; } $rawToken = base64_decode($tokenSeed); $tokenHash = hash_hmac($algorithm, $rawToken, $siteSecret); $userId = $this->form->getData()->get('id'); $message = base64_encode("$algorithm:$userId:$tokenHash"); if ($userId != Factory::getUser()->id) { $message = ''; } return $message; } /** * Get the data for the layout * * @return array * * @since 4.0.0 */ protected function getLayoutData() { $data = parent::getLayoutData(); $data['value'] = $this->getTokenForDisplay($this->value); return $data; } }
| ver. 1.4 |
Github
|
.
| PHP 8.3.23 | Generation time: 0.06 |
proxy
|
phpinfo
|
Settings