lepton_securecms.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
class LEPTON_securecms
{
    public string $_salt = '';
    
    public function __construct()
    {
        $this->_generate_salt();
    }
    
    public function _generate_salt(): void
    {
        LEPTON_handle::register("random_string");
 
        $salt  = random_string(28);
        $salt .= PHP_VERSION;
        $salt .= (string)time();
        
        $this->_salt = $salt;
    }
    
    public function createLepToken(): string
    {
        if (function_exists('microtime'))
        {
            list($usec, $sec) = explode(" ", microtime());
            $time = (string) ((float) $usec + (float) $sec);
        }
        else
        {
            $time = (string) time();
        }
        
        $token = substr(hash("sha512", $time . $this->_salt), 0, 21) . "z" . substr($time, 0, 10);
        if (isset($_SESSION['LEPTOKENS']))
        {
            $_SESSION['LEPTOKENS'][] = $token;
        }
        else
        {
            $_SESSION['LEPTOKENS'] = [0 => $token];
        }
        return $token;
    }
    
    public function checkLepToken(): bool
    {
        if (!LEPTOKEN_LIFETIME)
        {
            return true;
        }
        
        $retval    = false;
        
        if (isset($_GET['leptoken']))
        {
            $currentToken= $_GET['leptoken'];
        }
        elseif (isset($_GET['amp;leptoken']))
        {
            $currentToken= $_GET['amp;leptoken'];
        }
        elseif (isset($_POST['leptoken']))
        {
            $currentToken= $_POST['leptoken'];
        }
        elseif (isset($_POST['amp;leptoken']))
        {
            $currentToken= $_POST['amp;leptoken'];
        }
        else
        {
            return $retval;
        }
        
        if (isset($_SESSION['LEPTOKENS']))
        {
            // Delete out-dated tokens
            if ($this->deleteLepTokensByTimeout())
            {            
                foreach ($_SESSION['LEPTOKENS'] as $index => $value)
                {
                    if ($currentToken == $value)
                    {
                        $retval = true;
                        break;
                    }
                }
 
                // If none match delete all LEPTOKEN
                if ($retval == false)
                {
                    unset($_SESSION['LEPTOKENS']);
                }
            }
        }
 
        return $retval;
    }
 
    /*
     * delete all Tokens in $_SESSION
     * @access public
     * for use in frontend addons to prevent backend access
     *
     * requirements: an active session must be available and LEPTOKEN must be enabled!
     * 
     */
    static public function clearLepTokens(): void
    {
        if (isset($_SESSION['LEPTOKENS']) && isset($_SESSION['GROUPS_ID']))
        {
            $aTemp = explode(", ", $_SESSION['GROUPS_ID']);
            if ((!in_array(1, $aTemp)) && ((false === LEPTON_admin::getUserPermission("settings_backend_access")) && (false === LEPTON_admin::getUserPermission("backend_access"))))
            {
                unset($_SESSION['LEPTOKENS']);
            }
        } 
    }
 
    private function deleteLepTokensByTimeout(): bool
    {
        $timeOut = intval(time() - LEPTOKEN_LIFETIME);
        foreach ($_SESSION['LEPTOKENS'] as $index => $value)
        {
            $tempTerms = explode("z", $value);
            $tokenTime = intval($tempTerms[1]);
            if ($tokenTime < $timeOut)
            {
                unset($_SESSION['LEPTOKENS']);
                return false;
            } 
        }
 
        return true;
    }
}