Forms: Move class to the right place
Drop some methods we do not need anymore (all model related). refs #4355
This commit is contained in:
Marius Hein
parent
2469e3652c
commit
dc878de275
|
|
@ -0,0 +1,164 @@
|
||||||
|
<?php
|
||||||
|
// {{{ICINGA_LICENSE_HEADER}}}
|
||||||
|
/**
|
||||||
|
* Icinga 2 Web - Head for multiple monitoring frontends
|
||||||
|
* Copyright (C) 2013 Icinga Development Team
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or
|
||||||
|
* modify it under the terms of the GNU General Public License
|
||||||
|
* as published by the Free Software Foundation; either version 2
|
||||||
|
* of the License, or (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
||||||
|
*
|
||||||
|
* @copyright 2013 Icinga Development Team <info@icinga.org>
|
||||||
|
* @author Icinga Development Team <info@icinga.org>
|
||||||
|
*/
|
||||||
|
// {{{ICINGA_LICENSE_HEADER}}}
|
||||||
|
|
||||||
|
namespace Icinga\Web;
|
||||||
|
|
||||||
|
use Icinga\Exception\ProgrammingError;
|
||||||
|
|
||||||
|
abstract class Form extends \Zend_Form
|
||||||
|
{
|
||||||
|
/**
|
||||||
|
* The form's request object
|
||||||
|
* @var null
|
||||||
|
*/
|
||||||
|
private $request = null;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Whether this form should NOT add random generated "challenge" tokens that are associated
|
||||||
|
* with the user's current session in order to prevent Cross-Site Request Forgery (CSRF).
|
||||||
|
* It is the form's responsibility to verify the existence and correctness of this token
|
||||||
|
* @var bool
|
||||||
|
*/
|
||||||
|
private $tokenDisabled = false;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Name of the CSRF token element (used to create non-colliding hashes)
|
||||||
|
* @var string
|
||||||
|
*/
|
||||||
|
private $tokenElementName = 'CSRFToken';
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Time to live for the CRSF token
|
||||||
|
* @var int
|
||||||
|
*/
|
||||||
|
private $tokenTimeout = 300;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @see Zend_Form::init
|
||||||
|
*/
|
||||||
|
public function init()
|
||||||
|
{
|
||||||
|
if (!$this->tokenDisabled) {
|
||||||
|
$this->initCsrfToken();
|
||||||
|
}
|
||||||
|
$this->create();
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Add elements to this form (used by extending classes)
|
||||||
|
*/
|
||||||
|
abstract public function create();
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Apply a request object wherewith the form can work
|
||||||
|
*
|
||||||
|
* @param $request The request object of a session
|
||||||
|
*/
|
||||||
|
public function setRequest($request)
|
||||||
|
{
|
||||||
|
$this->request = $request;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Enable CSRF counter measure
|
||||||
|
*/
|
||||||
|
final public function enableCsrfToken()
|
||||||
|
{
|
||||||
|
$this->tokenDisabled = false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Disable CSRF counter measure and remove its field if already added
|
||||||
|
*/
|
||||||
|
final public function disableCsrfToken()
|
||||||
|
{
|
||||||
|
$this->tokenDisabled = true;
|
||||||
|
$this->removeElement($this->tokenElementName);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Add CSRF counter measure field to form
|
||||||
|
*/
|
||||||
|
final public function initCsrfToken()
|
||||||
|
{
|
||||||
|
if ($this->tokenDisabled || $this->getElement($this->tokenElementName)) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
list($seed, $token) = $this->generateCsrfToken($this->tokenTimeout);
|
||||||
|
|
||||||
|
$this->addElement('hidden', $this->tokenElementName, array(
|
||||||
|
'value' => sprintf('%s\|/%s', $seed, $token),
|
||||||
|
'decorators' => array('ViewHelper')
|
||||||
|
)
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Check whether the form's CSRF token-field has a valid value
|
||||||
|
*
|
||||||
|
* @param int $maxAge Max allowed token age
|
||||||
|
* @param string $sessionId A specific session id
|
||||||
|
*
|
||||||
|
* @return bool
|
||||||
|
*/
|
||||||
|
final private function hasValidCsrfToken($maxAge, $sessionId = null)
|
||||||
|
{
|
||||||
|
if ($this->tokenDisabled) {
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($this->getElement($this->tokenElementName) === null) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
$elementValue = $this->getElement($this->tokenElementName)->getValue();
|
||||||
|
list($seed, $token) = explode($elementValue, '\|/');
|
||||||
|
|
||||||
|
if (!is_numeric($seed)) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
$seed -= intval(time() / $maxAge) * $maxAge;
|
||||||
|
$sessionId = $sessionId ? $sessionId : session_id();
|
||||||
|
return $token === hash('sha256', $sessionId . $seed);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Generate a new (seed, token) pair
|
||||||
|
*
|
||||||
|
* @param int $maxAge Max allowed token age
|
||||||
|
* @param string $sessionId A specific session id
|
||||||
|
*
|
||||||
|
* @return array
|
||||||
|
*/
|
||||||
|
final private function generateCsrfToken($maxAge, $sessionId = null)
|
||||||
|
{
|
||||||
|
$sessionId = $sessionId ? $sessionId : session_id();
|
||||||
|
$seed = mt_rand();
|
||||||
|
$hash = hash('sha256', $sessionId . $seed);
|
||||||
|
$seed += intval(time() / $maxAge) * $maxAge;
|
||||||
|
return array($seed, $hash);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -1,345 +0,0 @@
|
||||||
<?php
|
|
||||||
// {{{ICINGA_LICENSE_HEADER}}}
|
|
||||||
/**
|
|
||||||
* Icinga 2 Web - Head for multiple monitoring frontends
|
|
||||||
* Copyright (C) 2013 Icinga Development Team
|
|
||||||
*
|
|
||||||
* This program is free software; you can redistribute it and/or
|
|
||||||
* modify it under the terms of the GNU General Public License
|
|
||||||
* as published by the Free Software Foundation; either version 2
|
|
||||||
* of the License, or (at your option) any later version.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
||||||
*
|
|
||||||
* @copyright 2013 Icinga Development Team <info@icinga.org>
|
|
||||||
* @author Icinga Development Team <info@icinga.org>
|
|
||||||
*/
|
|
||||||
// {{{ICINGA_LICENSE_HEADER}}}
|
|
||||||
|
|
||||||
namespace Icinga\Form;
|
|
||||||
|
|
||||||
use Icinga\Exception\ProgrammingError;
|
|
||||||
|
|
||||||
abstract class Form extends \Zend_Form
|
|
||||||
{
|
|
||||||
/**
|
|
||||||
* The form's request object
|
|
||||||
* @var null
|
|
||||||
*/
|
|
||||||
private $request = null;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* The underlying model for this form
|
|
||||||
* @var null
|
|
||||||
*/
|
|
||||||
private $boundModel = null;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Whether this form should NOT add random generated "challenge" tokens that are associated
|
|
||||||
* with the user's current session in order to prevent Cross-Site Request Forgery (CSRF).
|
|
||||||
* It is the form's responsibility to verify the existence and correctness of this token
|
|
||||||
* @var bool
|
|
||||||
*/
|
|
||||||
private $tokenDisabled = false;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Name of the CSRF token element (used to create non-colliding hashes)
|
|
||||||
* @var string
|
|
||||||
*/
|
|
||||||
private $tokenElementName = 'CSRFToken';
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Time to live for the CRSF token
|
|
||||||
* @var int
|
|
||||||
*/
|
|
||||||
private $tokenTimeout = 300;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* @see Zend_Form::init
|
|
||||||
*/
|
|
||||||
public function init()
|
|
||||||
{
|
|
||||||
if (!$this->tokenDisabled) {
|
|
||||||
$this->initCsrfToken();
|
|
||||||
}
|
|
||||||
$this->create();
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Add elements to this form (used by extending classes)
|
|
||||||
*/
|
|
||||||
abstract public function create();
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Apply a request object wherewith the form can work
|
|
||||||
*
|
|
||||||
* @param $request The request object of a session
|
|
||||||
* @return $this
|
|
||||||
*/
|
|
||||||
public function setRequest($request)
|
|
||||||
{
|
|
||||||
$this->request = $request;
|
|
||||||
return $this;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Check if the form's values are valid
|
|
||||||
*
|
|
||||||
* If $data is not given, $_POST is used.
|
|
||||||
*
|
|
||||||
* @param array $data
|
|
||||||
* @return bool
|
|
||||||
*/
|
|
||||||
/* @TODO: isValid cannot be overwritten this way. The CSRF functionality needs to
|
|
||||||
* be implemented as separate Zend_Form_Element with its own validator.
|
|
||||||
*
|
|
||||||
public function isValid(array $data = null)
|
|
||||||
{
|
|
||||||
if ($data === null) {
|
|
||||||
$data = $_POST;
|
|
||||||
}
|
|
||||||
return $this->hasValidCsrfToken($this->tokenTimeout) && parent::isValid($data);
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Check if the form was submitted
|
|
||||||
*
|
|
||||||
* @param string $elementName
|
|
||||||
* @return bool
|
|
||||||
*/
|
|
||||||
public function isSubmitted($elementName)
|
|
||||||
{
|
|
||||||
$element = $this->getElement($elementName);
|
|
||||||
if ($element) {
|
|
||||||
if ($this->request->isGet()) {
|
|
||||||
return $this->request->getQuery($elementName) === $element->getLabel();
|
|
||||||
} elseif ($this->request->isPost()) {
|
|
||||||
return $this->request->getPost($elementName) === $element->getLabel();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Populate form with the given information
|
|
||||||
*
|
|
||||||
* $model might be an array or object where each key/property represents the name
|
|
||||||
* of an element. In case its a object it might also have getter for each element.
|
|
||||||
* (Naming: getExample) If $updateModel is false the underlying model, if any,
|
|
||||||
* will not be updated.
|
|
||||||
*
|
|
||||||
* @param array|object $model
|
|
||||||
* @param bool $updateModel
|
|
||||||
* @throws \InvalidArgumentException
|
|
||||||
*/
|
|
||||||
public function populate($model, $updateModel = true)
|
|
||||||
{
|
|
||||||
if (is_array($model)) {
|
|
||||||
parent::populate($model);
|
|
||||||
} elseif (is_object($model)) {
|
|
||||||
$this->populateFromObject($model);
|
|
||||||
} else {
|
|
||||||
throw new \InvalidArgumentException("Expected array or object. $model given");
|
|
||||||
}
|
|
||||||
if ($updateModel && $this->boundModel !== null) {
|
|
||||||
$this->updateModel();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Populate form with the given object
|
|
||||||
*
|
|
||||||
* @param object $model
|
|
||||||
*/
|
|
||||||
private function populateFromObject($model)
|
|
||||||
{
|
|
||||||
foreach ($this->getElements() as $name => $element) {
|
|
||||||
if (isset($model->$name)) {
|
|
||||||
$element->setValue($model->$name);
|
|
||||||
} else {
|
|
||||||
$getter = 'get' . ucfirst($name);
|
|
||||||
if (method_exists($model, $getter)) {
|
|
||||||
$element->setValue($model->$getter());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Repopulate form with the current request
|
|
||||||
*/
|
|
||||||
public function repopulate()
|
|
||||||
{
|
|
||||||
if ($this->request->isPost()) {
|
|
||||||
$this->populate($this->request->getPost());
|
|
||||||
} elseif ($this->request->isGet()) {
|
|
||||||
$this->populate($this->request->getQuery());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Bind a model to this form
|
|
||||||
*
|
|
||||||
* $model might be an array or object where each key/property represents
|
|
||||||
* the name of an element. In case its a object it might also have getter
|
|
||||||
* and setter for each element. (Naming: getExample, setExample)
|
|
||||||
*
|
|
||||||
* @param array|object $model
|
|
||||||
*/
|
|
||||||
public function bindToModel(&$model)
|
|
||||||
{
|
|
||||||
$this->boundModel = &$model;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Synchronize form with model
|
|
||||||
*
|
|
||||||
* Feed the form's elements with default values by using the current model.
|
|
||||||
*
|
|
||||||
* @throws ProgrammingError
|
|
||||||
*/
|
|
||||||
public function syncWithModel()
|
|
||||||
{
|
|
||||||
if ($this->boundModel === null) {
|
|
||||||
throw new ProgrammingError('You need to bind a model to this form first');
|
|
||||||
}
|
|
||||||
$this->populate($this->boundModel, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Update model with the form's values
|
|
||||||
*
|
|
||||||
* This is the inverse of syncWithModel(). Feed the
|
|
||||||
* model with values from the form's elements.
|
|
||||||
*
|
|
||||||
* @throws ProgrammingError
|
|
||||||
*/
|
|
||||||
public function updateModel()
|
|
||||||
{
|
|
||||||
if (is_array($this->boundModel)) {
|
|
||||||
$this->updateArrayModel();
|
|
||||||
} elseif (is_object($this->boundModel)) {
|
|
||||||
$this->updateObjectModel();
|
|
||||||
} else {
|
|
||||||
throw new ProgrammingError('You need to bind a model to this form first');
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Update model of type object
|
|
||||||
*/
|
|
||||||
private function updateObjectModel()
|
|
||||||
{
|
|
||||||
foreach ($this->getElements() as $name => $element) {
|
|
||||||
if (isset($this->boundModel->$name)) {
|
|
||||||
$this->boundModel->$name = $element->getValue();
|
|
||||||
} else {
|
|
||||||
$setter = 'set' . ucfirst($name);
|
|
||||||
if (method_exists($this->boundModel, $setter)) {
|
|
||||||
$this->boundModel->$setter($element->getValue());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Update model of type array
|
|
||||||
*/
|
|
||||||
private function updateArrayModel()
|
|
||||||
{
|
|
||||||
foreach ($this->getElements() as $name => $element) {
|
|
||||||
if (isset($this->boundModel[$name])) {
|
|
||||||
$this->boundModel[$name] = $element->getValue();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Enable CSRF counter measure
|
|
||||||
*/
|
|
||||||
final public function enableCsrfToken()
|
|
||||||
{
|
|
||||||
$this->tokenDisabled = false;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Disable CSRF counter measure and remove its field if already added
|
|
||||||
*/
|
|
||||||
final public function disableCsrfToken()
|
|
||||||
{
|
|
||||||
$this->tokenDisabled = true;
|
|
||||||
$this->removeElement($this->tokenElementName);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Add CSRF counter measure field to form
|
|
||||||
*/
|
|
||||||
final public function initCsrfToken()
|
|
||||||
{
|
|
||||||
if ($this->tokenDisabled || $this->getElement($this->tokenElementName)) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
list($seed, $token) = $this->generateCsrfToken($this->tokenTimeout);
|
|
||||||
|
|
||||||
$this->addElement('hidden', $this->tokenElementName, array(
|
|
||||||
'value' => sprintf('%s\|/%s', $seed, $token),
|
|
||||||
'decorators' => array('ViewHelper')
|
|
||||||
)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Check whether the form's CSRF token-field has a valid value
|
|
||||||
*
|
|
||||||
* @param int $maxAge Max allowed token age
|
|
||||||
* @param string $sessionId A specific session id
|
|
||||||
*
|
|
||||||
* @return bool
|
|
||||||
*/
|
|
||||||
final private function hasValidCsrfToken($maxAge, $sessionId = null)
|
|
||||||
{
|
|
||||||
if ($this->tokenDisabled) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ($this->getElement($this->tokenElementName) === null) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
$elementValue = $this->getElement($this->tokenElementName)->getValue();
|
|
||||||
list($seed, $token) = explode($elementValue, '\|/');
|
|
||||||
|
|
||||||
if (!is_numeric($seed)) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
$seed -= intval(time() / $maxAge) * $maxAge;
|
|
||||||
$sessionId = $sessionId ? $sessionId : session_id();
|
|
||||||
return $token === hash('sha256', $sessionId . $seed);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Generate a new (seed, token) pair
|
|
||||||
*
|
|
||||||
* @param int $maxAge Max allowed token age
|
|
||||||
* @param string $sessionId A specific session id
|
|
||||||
*
|
|
||||||
* @return array
|
|
||||||
*/
|
|
||||||
final private function generateCsrfToken($maxAge, $sessionId = null)
|
|
||||||
{
|
|
||||||
$sessionId = $sessionId ? $sessionId : session_id();
|
|
||||||
$seed = mt_rand();
|
|
||||||
$hash = hash('sha256', $sessionId . $seed);
|
|
||||||
$seed += intval(time() / $maxAge) * $maxAge;
|
|
||||||
return array($seed, $hash);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Loading…
Reference in New Issue