You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

112 lines
2.8 KiB

3 years ago
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2016, ownCloud, Inc.
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Lukas Reschke <lukas@statuscode.ch>
  8. * @author Roeland Jago Douma <roeland@famdouma.nl>
  9. *
  10. * @license AGPL-3.0
  11. *
  12. * This code is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License, version 3,
  14. * as published by the Free Software Foundation.
  15. *
  16. * This program is distributed in the hope that it will be useful,
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. * GNU Affero General Public License for more details.
  20. *
  21. * You should have received a copy of the GNU Affero General Public License, version 3,
  22. * along with this program. If not, see <http://www.gnu.org/licenses/>
  23. *
  24. */
  25. namespace OC\Security\CSRF;
  26. use OC\Security\CSRF\TokenStorage\SessionStorage;
  27. /**
  28. * Class CsrfTokenManager is the manager for all CSRF token related activities.
  29. *
  30. * @package OC\Security\CSRF
  31. */
  32. class CsrfTokenManager {
  33. /** @var CsrfTokenGenerator */
  34. private $tokenGenerator;
  35. /** @var SessionStorage */
  36. private $sessionStorage;
  37. /** @var CsrfToken|null */
  38. private $csrfToken = null;
  39. /**
  40. * @param CsrfTokenGenerator $tokenGenerator
  41. * @param SessionStorage $storageInterface
  42. */
  43. public function __construct(CsrfTokenGenerator $tokenGenerator,
  44. SessionStorage $storageInterface) {
  45. $this->tokenGenerator = $tokenGenerator;
  46. $this->sessionStorage = $storageInterface;
  47. }
  48. /**
  49. * Returns the current CSRF token, if none set it will create a new one.
  50. *
  51. * @return CsrfToken
  52. */
  53. public function getToken(): CsrfToken {
  54. if (!\is_null($this->csrfToken)) {
  55. return $this->csrfToken;
  56. }
  57. if ($this->sessionStorage->hasToken()) {
  58. $value = $this->sessionStorage->getToken();
  59. } else {
  60. $value = $this->tokenGenerator->generateToken();
  61. $this->sessionStorage->setToken($value);
  62. }
  63. $this->csrfToken = new CsrfToken($value);
  64. return $this->csrfToken;
  65. }
  66. /**
  67. * Invalidates any current token and sets a new one.
  68. *
  69. * @return CsrfToken
  70. */
  71. public function refreshToken(): CsrfToken {
  72. $value = $this->tokenGenerator->generateToken();
  73. $this->sessionStorage->setToken($value);
  74. $this->csrfToken = new CsrfToken($value);
  75. return $this->csrfToken;
  76. }
  77. /**
  78. * Remove the current token from the storage.
  79. */
  80. public function removeToken() {
  81. $this->csrfToken = null;
  82. $this->sessionStorage->removeToken();
  83. }
  84. /**
  85. * Verifies whether the provided token is valid.
  86. *
  87. * @param CsrfToken $token
  88. * @return bool
  89. */
  90. public function isTokenValid(CsrfToken $token): bool {
  91. if (!$this->sessionStorage->hasToken()) {
  92. return false;
  93. }
  94. return hash_equals(
  95. $this->sessionStorage->getToken(),
  96. $token->getDecryptedValue()
  97. );
  98. }
  99. }