FM / Component

/var/www/vhosts/ihelp.ro/_OLD/vendor/cakephp/cakephp/src/Controller/Component/

/var/www/vhosts/ihelp.ro/_OLD/vendor/cakephp/cakephp/src/Controller/Component

Name	Size	Mode	Actions
AuthComponent.php	33379	0644	edit dl rm
FlashComponent.php	5744	0644	edit dl rm
FormProtectionComponent.php	5611	0644	edit dl rm
PaginatorComponent.php	10744	0644	edit dl rm
RequestHandlerComponent.php	18385	0644	edit dl rm
SecurityComponent.php	20594	0644	edit dl rm

Edit: /var/www/vhosts/ihelp.ro/_OLD/vendor/cakephp/cakephp/src/Controller/Component/SecurityComponent.php (20594B)

<?php
declare(strict_types=1);

/**
 * CakePHP(tm) : Rapid Development Framework (https://cakephp.org)
 * Copyright (c) Cake Software Foundation, Inc. (https://cakefoundation.org)
 *
 * Licensed under The MIT License
 * For full copyright and license information, please see the LICENSE.txt
 * Redistributions of files must retain the above copyright notice.
 *
 * @copyright     Copyright (c) Cake Software Foundation, Inc. (https://cakefoundation.org)
 * @link          https://cakephp.org CakePHP(tm) Project
 * @since         0.10.8
 * @license       https://opensource.org/licenses/mit-license.php MIT License
 */
namespace Cake\Controller\Component;

use Cake\Controller\Component;
use Cake\Controller\Controller;
use Cake\Controller\Exception\AuthSecurityException;
use Cake\Controller\Exception\SecurityException;
use Cake\Core\Configure;
use Cake\Event\EventInterface;
use Cake\Http\Exception\BadRequestException;
use Cake\Http\Response;
use Cake\Http\ServerRequest;
use Cake\Routing\Router;
use Cake\Utility\Hash;
use Cake\Utility\Security;

/**
 * The Security Component creates an easy way to integrate tighter security in
 * your application. It provides methods for these tasks:
 *
 * - Form tampering protection.
 * - Requiring that SSL be used.
 *
 * @link https://book.cakephp.org/4/en/controllers/components/security.html
 * @deprecated 4.0.0 Use {@link FormProtectionComponent} instead, for form tampering protection
 *   or {@link HttpsEnforcerMiddleware} to enforce use of HTTPS (SSL) for requests.
 */
class SecurityComponent extends Component
{
    /**
     * Default message used for exceptions thrown
     *
     * @var string
     */
    public const DEFAULT_EXCEPTION_MESSAGE = 'The request has been black-holed';

/**
     * Default config
     *
     * - `blackHoleCallback` - The controller method that will be called if this
     *   request is black-hole'd.
     * - `requireSecure` - List of actions that require an SSL-secured connection.
     * - `unlockedFields` - Form fields to exclude from POST validation. Fields can
     *   be unlocked either in the Component, or with FormHelper::unlockField().
     *   Fields that have been unlocked are not required to be part of the POST
     *   and hidden unlocked fields do not have their values checked.
     * - `unlockedActions` - Actions to exclude from POST validation checks.
     *   Other checks like requireSecure() etc. will still be applied.
     * - `validatePost` - Whether to validate POST data. Set to false to disable
     *   for data coming from 3rd party services, etc.
     *
     * @var array
     */
    protected $_defaultConfig = [
        'blackHoleCallback' => null,
        'requireSecure' => [],
        'unlockedFields' => [],
        'unlockedActions' => [],
        'validatePost' => true,
    ];

/**
     * Holds the current action of the controller
     *
     * @var string
     */
    protected $_action;

/**
     * Component startup. All security checking happens here.
     *
     * @param \Cake\Event\EventInterface $event An Event instance
     * @return \Cake\Http\Response|null
     */
    public function startup(EventInterface $event): ?Response
    {
        /** @var \Cake\Controller\Controller $controller */
        $controller = $event->getSubject();
        $request = $controller->getRequest();
        $this->_action = $request->getParam('action');
        $hasData = ($request->getData() || $request->is(['put', 'post', 'delete', 'patch']));
        try {
            $this->_secureRequired($controller);

if ($this->_action === $this->_config['blackHoleCallback']) {
                throw new AuthSecurityException(sprintf(
                    'Action %s is defined as the blackhole callback.',
                    $this->_action
                ));
            }

if (
                !in_array($this->_action, (array)$this->_config['unlockedActions'], true) &&
                $hasData &&
                $this->_config['validatePost']
            ) {
                $this->_validatePost($controller);
            }
        } catch (SecurityException $se) {
            return $this->blackHole($controller, $se->getType(), $se);
        }

$request = $this->generateToken($request);
        if ($hasData && is_array($controller->getRequest()->getData())) {
            $request = $request->withoutData('_Token');
        }
        $controller->setRequest($request);

return null;
    }

/**
     * Events supported by this component.
     *
     * @return array
     */
    public function implementedEvents(): array
    {
        return [
            'Controller.startup' => 'startup',
        ];
    }

/**
     * Sets the actions that require a request that is SSL-secured, or empty for all actions
     *
     * @param string|string[]|null $actions Actions list
     * @return void
     */
    public function requireSecure($actions = null): void
    {
        $actions = (array)$actions;
        $this->setConfig('requireSecure', empty($actions) ? ['*'] : $actions);
    }

/**
     * Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback
     * is specified, it will use this callback by executing the method indicated in $error
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @param string $error Error method
     * @param \Cake\Controller\Exception\SecurityException|null $exception Additional debug info describing the cause
     * @return mixed If specified, controller blackHoleCallback's response, or no return otherwise
     * @see \Cake\Controller\Component\SecurityComponent::$blackHoleCallback
     * @link https://book.cakephp.org/4/en/controllers/components/security.html#handling-blackhole-callbacks
     * @throws \Cake\Http\Exception\BadRequestException
     */
    public function blackHole(Controller $controller, string $error = '', ?SecurityException $exception = null)
    {
        if (!$this->_config['blackHoleCallback']) {
            $this->_throwException($exception);
        }

return $this->_callback($controller, $this->_config['blackHoleCallback'], [$error, $exception]);
    }

/**
     * Check debug status and throw an Exception based on the existing one
     *
     * @param \Cake\Controller\Exception\SecurityException|null $exception Additional debug info describing the cause
     * @throws \Cake\Http\Exception\BadRequestException
     * @return void
     */
    protected function _throwException(?SecurityException $exception = null): void
    {
        if ($exception !== null) {
            if (!Configure::read('debug')) {
                $exception->setReason($exception->getMessage());
                $exception->setMessage(static::DEFAULT_EXCEPTION_MESSAGE);
            }
            throw $exception;
        }
        throw new BadRequestException(static::DEFAULT_EXCEPTION_MESSAGE);
    }

/**
     * Check if access requires secure connection
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @return void
     * @throws \Cake\Controller\Exception\SecurityException
     */
    protected function _secureRequired(Controller $controller): void
    {
        if (
            empty($this->_config['requireSecure']) ||
            !is_array($this->_config['requireSecure'])
        ) {
            return;
        }

$requireSecure = $this->_config['requireSecure'];
        if (
            ($requireSecure[0] === '*' ||
                in_array($this->_action, $requireSecure, true)
            ) &&
            !$controller->getRequest()->is('ssl')
        ) {
            throw new SecurityException(
                'Request is not SSL and the action is required to be secure'
            );
        }
    }

/**
     * Validate submitted form
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @return void
     * @throws \Cake\Controller\Exception\AuthSecurityException
     */
    protected function _validatePost(Controller $controller): void
    {
        $token = $this->_validToken($controller);
        $hashParts = $this->_hashParts($controller);
        $check = hash_hmac('sha1', implode('', $hashParts), Security::getSalt());

if (hash_equals($check, $token)) {
            return;
        }

$msg = static::DEFAULT_EXCEPTION_MESSAGE;
        if (Configure::read('debug')) {
            $msg = $this->_debugPostTokenNotMatching($controller, $hashParts);
        }

throw new AuthSecurityException($msg);
    }

/**
     * Check if token is valid
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @throws \Cake\Controller\Exception\SecurityException
     * @return string fields token
     */
    protected function _validToken(Controller $controller): string
    {
        $check = $controller->getRequest()->getData();

$message = '\'%s\' was not found in request data.';
        if (!isset($check['_Token'])) {
            throw new AuthSecurityException(sprintf($message, '_Token'));
        }
        if (!isset($check['_Token']['fields'])) {
            throw new AuthSecurityException(sprintf($message, '_Token.fields'));
        }
        if (!is_string($check['_Token']['fields'])) {
            throw new AuthSecurityException("'_Token.fields' is invalid.");
        }
        if (!isset($check['_Token']['unlocked'])) {
            throw new AuthSecurityException(sprintf($message, '_Token.unlocked'));
        }
        if (Configure::read('debug') && !isset($check['_Token']['debug'])) {
            throw new SecurityException(sprintf($message, '_Token.debug'));
        }
        if (!Configure::read('debug') && isset($check['_Token']['debug'])) {
            throw new SecurityException('Unexpected \'_Token.debug\' found in request data');
        }

$token = urldecode($check['_Token']['fields']);
        if (strpos($token, ':')) {
            [$token, ] = explode(':', $token, 2);
        }

return $token;
    }

/**
     * Return hash parts for the Token generation
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @return string[]
     */
    protected function _hashParts(Controller $controller): array
    {
        $request = $controller->getRequest();

// Start the session to ensure we get the correct session id.
        $session = $request->getSession();
        $session->start();

$data = (array)$request->getData();
        $fieldList = $this->_fieldsList($data);
        $unlocked = $this->_sortedUnlocked($data);

return [
            Router::url($request->getRequestTarget()),
            serialize($fieldList),
            $unlocked,
            $session->id(),
        ];
    }

/**
     * Return the fields list for the hash calculation
     *
     * @param array $check Data array
     * @return array
     */
    protected function _fieldsList(array $check): array
    {
        $locked = '';
        $token = urldecode($check['_Token']['fields']);
        $unlocked = $this->_unlocked($check);

if (strpos($token, ':')) {
            [, $locked] = explode(':', $token, 2);
        }
        unset($check['_Token']);

$locked = $locked ? explode('|', $locked) : [];
        $unlocked = $unlocked ? explode('|', $unlocked) : [];

$fields = Hash::flatten($check);
        $fieldList = array_keys($fields);
        $multi = $lockedFields = [];
        $isUnlocked = false;

foreach ($fieldList as $i => $key) {
            if (is_string($key) && preg_match('/(\.\d+){1,10}$/', $key)) {
                $multi[$i] = preg_replace('/(\.\d+){1,10}$/', '', $key);
                unset($fieldList[$i]);
            } else {
                $fieldList[$i] = (string)$key;
            }
        }
        if (!empty($multi)) {
            $fieldList += array_unique($multi);
        }

$unlockedFields = array_unique(
            array_merge(
                (array)$this->_config['unlockedFields'],
                $unlocked
            )
        );

foreach ($fieldList as $i => $key) {
            $isLocked = in_array($key, $locked, true);

if (!empty($unlockedFields)) {
                foreach ($unlockedFields as $off) {
                    $off = explode('.', $off);
                    $field = array_values(array_intersect(explode('.', $key), $off));
                    $isUnlocked = ($field === $off);
                    if ($isUnlocked) {
                        break;
                    }
                }
            }

if ($isUnlocked || $isLocked) {
                unset($fieldList[$i]);
                if ($isLocked) {
                    $lockedFields[$key] = $fields[$key];
                }
            }
        }
        sort($fieldList, SORT_STRING);
        ksort($lockedFields, SORT_STRING);
        $fieldList += $lockedFields;

return $fieldList;
    }

/**
     * Get the unlocked string
     *
     * @param array $data Data array
     * @return string
     */
    protected function _unlocked(array $data): string
    {
        return urldecode($data['_Token']['unlocked']);
    }

/**
     * Get the sorted unlocked string
     *
     * @param array $data Data array
     * @return string
     */
    protected function _sortedUnlocked(array $data): string
    {
        $unlocked = $this->_unlocked($data);
        $unlocked = explode('|', $unlocked);
        sort($unlocked, SORT_STRING);

return implode('|', $unlocked);
    }

/**
     * Create a message for humans to understand why Security token is not matching
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @param array $hashParts Elements used to generate the Token hash
     * @return string Message explaining why the tokens are not matching
     */
    protected function _debugPostTokenNotMatching(Controller $controller, array $hashParts): string
    {
        $messages = [];
        $expectedParts = json_decode(urldecode($controller->getRequest()->getData('_Token.debug')), true);
        if (!is_array($expectedParts) || count($expectedParts) !== 3) {
            return 'Invalid security debug token.';
        }
        $expectedUrl = Hash::get($expectedParts, 0);
        $url = Hash::get($hashParts, 0);
        if ($expectedUrl !== $url) {
            $messages[] = sprintf('URL mismatch in POST data (expected \'%s\' but found \'%s\')', $expectedUrl, $url);
        }
        $expectedFields = Hash::get($expectedParts, 1);
        $dataFields = Hash::get($hashParts, 1);
        if ($dataFields) {
            $dataFields = unserialize($dataFields);
        }
        $fieldsMessages = $this->_debugCheckFields(
            $dataFields,
            $expectedFields,
            'Unexpected field \'%s\' in POST data',
            'Tampered field \'%s\' in POST data (expected value \'%s\' but found \'%s\')',
            'Missing field \'%s\' in POST data'
        );
        $expectedUnlockedFields = Hash::get($expectedParts, 2);
        $dataUnlockedFields = Hash::get($hashParts, 2) ?: null;
        if ($dataUnlockedFields) {
            $dataUnlockedFields = explode('|', $dataUnlockedFields);
        }
        $unlockFieldsMessages = $this->_debugCheckFields(
            (array)$dataUnlockedFields,
            $expectedUnlockedFields,
            'Unexpected unlocked field \'%s\' in POST data',
            '',
            'Missing unlocked field: \'%s\''
        );

$messages = array_merge($messages, $fieldsMessages, $unlockFieldsMessages);

return implode(', ', $messages);
    }

/**
     * Iterates data array to check against expected
     *
     * @param array $dataFields Fields array, containing the POST data fields
     * @param array $expectedFields Fields array, containing the expected fields we should have in POST
     * @param string $intKeyMessage Message string if unexpected found in data fields indexed by int (not protected)
     * @param string $stringKeyMessage Message string if tampered found in
     *  data fields indexed by string (protected).
     * @param string $missingMessage Message string if missing field
     * @return string[] Messages
     */
    protected function _debugCheckFields(
        array $dataFields,
        array $expectedFields = [],
        string $intKeyMessage = '',
        string $stringKeyMessage = '',
        string $missingMessage = ''
    ): array {
        $messages = $this->_matchExistingFields($dataFields, $expectedFields, $intKeyMessage, $stringKeyMessage);
        $expectedFieldsMessage = $this->_debugExpectedFields($expectedFields, $missingMessage);
        if ($expectedFieldsMessage !== null) {
            $messages[] = $expectedFieldsMessage;
        }

return $messages;
    }

/**
     * Manually add form tampering prevention token information into the provided
     * request object.
     *
     * @param \Cake\Http\ServerRequest $request The request object to add into.
     * @return \Cake\Http\ServerRequest The modified request.
     */
    public function generateToken(ServerRequest $request): ServerRequest
    {
        $token = [
            'unlockedFields' => $this->_config['unlockedFields'],
        ];

return $request->withAttribute('formTokenData', [
            'unlockedFields' => $token['unlockedFields'],
        ]);
    }

/**
     * Calls a controller callback method
     *
     * @param \Cake\Controller\Controller $controller Instantiating controller
     * @param string $method Method to execute
     * @param array $params Parameters to send to method
     * @return mixed Controller callback method's response
     * @throws \Cake\Http\Exception\BadRequestException When a the blackholeCallback is not callable.
     */
    protected function _callback(Controller $controller, string $method, array $params = [])
    {
        $callable = [$controller, $method];

if (!is_callable($callable)) {
            throw new BadRequestException('The request has been black-holed');
        }

return $callable(...$params);
    }

/**
     * Generate array of messages for the existing fields in POST data, matching dataFields in $expectedFields
     * will be unset
     *
     * @param array $dataFields Fields array, containing the POST data fields
     * @param array $expectedFields Fields array, containing the expected fields we should have in POST
     * @param string $intKeyMessage Message string if unexpected found in data fields indexed by int (not protected)
     * @param string $stringKeyMessage Message string if tampered found in
     *   data fields indexed by string (protected)
     * @return string[] Error messages
     */
    protected function _matchExistingFields(
        array $dataFields,
        array &$expectedFields,
        string $intKeyMessage,
        string $stringKeyMessage
    ): array {
        $messages = [];
        foreach ($dataFields as $key => $value) {
            if (is_int($key)) {
                $foundKey = array_search($value, (array)$expectedFields, true);
                if ($foundKey === false) {
                    $messages[] = sprintf($intKeyMessage, $value);
                } else {
                    unset($expectedFields[$foundKey]);
                }
            } else {
                if (isset($expectedFields[$key]) && $value !== $expectedFields[$key]) {
                    $messages[] = sprintf($stringKeyMessage, $key, $expectedFields[$key], $value);
                }
                unset($expectedFields[$key]);
            }
        }

return $messages;
    }

/**
     * Generate debug message for the expected fields
     *
     * @param array $expectedFields Expected fields
     * @param string $missingMessage Message template
     * @return string|null Error message about expected fields
     */
    protected function _debugExpectedFields(array $expectedFields = [], string $missingMessage = ''): ?string
    {
        if (count($expectedFields) === 0) {
            return null;
        }

$expectedFieldNames = [];
        foreach ((array)$expectedFields as $key => $expectedField) {
            if (is_int($key)) {
                $expectedFieldNames[] = $expectedField;
            } else {
                $expectedFieldNames[] = $key;
            }
        }

return sprintf($missingMessage, implode(', ', $expectedFieldNames));
    }
}

null, 'requireSecure' => [], 'unlockedFields' => [], 'unlockedActions' => [], 'validatePost' => true, ]; /** * Holds the current action of the controller * * @var string */ protected $_action; /** * Component startup. All security checking happens here. * * @param \Cake\Event\EventInterface $event An Event instance * @return \Cake\Http\Response|null */ public function startup(EventInterface $event): ?Response { /** @var \Cake\Controller\Controller $controller */ $controller = $event->getSubject(); $request = $controller->getRequest(); $this->_action = $request->getParam('action'); $hasData = ($request->getData() || $request->is(['put', 'post', 'delete', 'patch'])); try { $this->_secureRequired($controller); if ($this->_action === $this->_config['blackHoleCallback']) { throw new AuthSecurityException(sprintf( 'Action %s is defined as the blackhole callback.', $this->_action )); } if ( !in_array($this->_action, (array)$this->_config['unlockedActions'], true) && $hasData && $this->_config['validatePost'] ) { $this->_validatePost($controller); } } catch (SecurityException $se) { return $this->blackHole($controller, $se->getType(), $se); } $request = $this->generateToken($request); if ($hasData && is_array($controller->getRequest()->getData())) { $request = $request->withoutData('_Token'); } $controller->setRequest($request); return null; } /** * Events supported by this component. * * @return array */ public function implementedEvents(): array { return [ 'Controller.startup' => 'startup', ]; } /** * Sets the actions that require a request that is SSL-secured, or empty for all actions * * @param string|string[]|null $actions Actions list * @return void */ public function requireSecure($actions = null): void { $actions = (array)$actions; $this->setConfig('requireSecure', empty($actions) ? ['*'] : $actions); } /** * Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback * is specified, it will use this callback by executing the method indicated in $error * * @param \Cake\Controller\Controller $controller Instantiating controller * @param string $error Error method * @param \Cake\Controller\Exception\SecurityException|null $exception Additional debug info describing the cause * @return mixed If specified, controller blackHoleCallback's response, or no return otherwise * @see \Cake\Controller\Component\SecurityComponent::$blackHoleCallback * @link https://book.cakephp.org/4/en/controllers/components/security.html#handling-blackhole-callbacks * @throws \Cake\Http\Exception\BadRequestException */ public function blackHole(Controller $controller, string $error = '', ?SecurityException $exception = null) { if (!$this->_config['blackHoleCallback']) { $this->_throwException($exception); } return $this->_callback($controller, $this->_config['blackHoleCallback'], [$error, $exception]); } /** * Check debug status and throw an Exception based on the existing one * * @param \Cake\Controller\Exception\SecurityException|null $exception Additional debug info describing the cause * @throws \Cake\Http\Exception\BadRequestException * @return void */ protected function _throwException(?SecurityException $exception = null): void { if ($exception !== null) { if (!Configure::read('debug')) { $exception->setReason($exception->getMessage()); $exception->setMessage(static::DEFAULT_EXCEPTION_MESSAGE); } throw $exception; } throw new BadRequestException(static::DEFAULT_EXCEPTION_MESSAGE); } /** * Check if access requires secure connection * * @param \Cake\Controller\Controller $controller Instantiating controller * @return void * @throws \Cake\Controller\Exception\SecurityException */ protected function _secureRequired(Controller $controller): void { if ( empty($this->_config['requireSecure']) || !is_array($this->_config['requireSecure']) ) { return; } $requireSecure = $this->_config['requireSecure']; if ( ($requireSecure[0] === '*' || in_array($this->_action, $requireSecure, true) ) && !$controller->getRequest()->is('ssl') ) { throw new SecurityException( 'Request is not SSL and the action is required to be secure' ); } } /** * Validate submitted form * * @param \Cake\Controller\Controller $controller Instantiating controller * @return void * @throws \Cake\Controller\Exception\AuthSecurityException */ protected function _validatePost(Controller $controller): void { $token = $this->_validToken($controller); $hashParts = $this->_hashParts($controller); $check = hash_hmac('sha1', implode('', $hashParts), Security::getSalt()); if (hash_equals($check, $token)) { return; } $msg = static::DEFAULT_EXCEPTION_MESSAGE; if (Configure::read('debug')) { $msg = $this->_debugPostTokenNotMatching($controller, $hashParts); } throw new AuthSecurityException($msg); } /** * Check if token is valid * * @param \Cake\Controller\Controller $controller Instantiating controller * @throws \Cake\Controller\Exception\SecurityException * @return string fields token */ protected function _validToken(Controller $controller): string { $check = $controller->getRequest()->getData(); $message = '\'%s\' was not found in request data.'; if (!isset($check['_Token'])) { throw new AuthSecurityException(sprintf($message, '_Token')); } if (!isset($check['_Token']['fields'])) { throw new AuthSecurityException(sprintf($message, '_Token.fields')); } if (!is_string($check['_Token']['fields'])) { throw new AuthSecurityException("'_Token.fields' is invalid."); } if (!isset($check['_Token']['unlocked'])) { throw new AuthSecurityException(sprintf($message, '_Token.unlocked')); } if (Configure::read('debug') && !isset($check['_Token']['debug'])) { throw new SecurityException(sprintf($message, '_Token.debug')); } if (!Configure::read('debug') && isset($check['_Token']['debug'])) { throw new SecurityException('Unexpected \'_Token.debug\' found in request data'); } $token = urldecode($check['_Token']['fields']); if (strpos($token, ':')) { [$token, ] = explode(':', $token, 2); } return $token; } /** * Return hash parts for the Token generation * * @param \Cake\Controller\Controller $controller Instantiating controller * @return string[] */ protected function _hashParts(Controller $controller): array { $request = $controller->getRequest(); // Start the session to ensure we get the correct session id. $session = $request->getSession(); $session->start(); $data = (array)$request->getData(); $fieldList = $this->_fieldsList($data); $unlocked = $this->_sortedUnlocked($data); return [ Router::url($request->getRequestTarget()), serialize($fieldList), $unlocked, $session->id(), ]; } /** * Return the fields list for the hash calculation * * @param array $check Data array * @return array */ protected function _fieldsList(array $check): array { $locked = ''; $token = urldecode($check['_Token']['fields']); $unlocked = $this->_unlocked($check); if (strpos($token, ':')) { [, $locked] = explode(':', $token, 2); } unset($check['_Token']); $locked = $locked ? explode('|', $locked) : []; $unlocked = $unlocked ? explode('|', $unlocked) : []; $fields = Hash::flatten($check); $fieldList = array_keys($fields); $multi = $lockedFields = []; $isUnlocked = false; foreach ($fieldList as $i => $key) { if (is_string($key) && preg_match('/(\.\d+){1,10}$/', $key)) { $multi[$i] = preg_replace('/(\.\d+){1,10}$/', '', $key); unset($fieldList[$i]); } else { $fieldList[$i] = (string)$key; } } if (!empty($multi)) { $fieldList += array_unique($multi); } $unlockedFields = array_unique( array_merge( (array)$this->_config['unlockedFields'], $unlocked ) ); foreach ($fieldList as $i => $key) { $isLocked = in_array($key, $locked, true); if (!empty($unlockedFields)) { foreach ($unlockedFields as $off) { $off = explode('.', $off); $field = array_values(array_intersect(explode('.', $key), $off)); $isUnlocked = ($field === $off); if ($isUnlocked) { break; } } } if ($isUnlocked || $isLocked) { unset($fieldList[$i]); if ($isLocked) { $lockedFields[$key] = $fields[$key]; } } } sort($fieldList, SORT_STRING); ksort($lockedFields, SORT_STRING); $fieldList += $lockedFields; return $fieldList; } /** * Get the unlocked string * * @param array $data Data array * @return string */ protected function _unlocked(array $data): string { return urldecode($data['_Token']['unlocked']); } /** * Get the sorted unlocked string * * @param array $data Data array * @return string */ protected function _sortedUnlocked(array $data): string { $unlocked = $this->_unlocked($data); $unlocked = explode('|', $unlocked); sort($unlocked, SORT_STRING); return implode('|', $unlocked); } /** * Create a message for humans to understand why Security token is not matching * * @param \Cake\Controller\Controller $controller Instantiating controller * @param array $hashParts Elements used to generate the Token hash * @return string Message explaining why the tokens are not matching */ protected function _debugPostTokenNotMatching(Controller $controller, array $hashParts): string { $messages = []; $expectedParts = json_decode(urldecode($controller->getRequest()->getData('_Token.debug')), true); if (!is_array($expectedParts) || count($expectedParts) !== 3) { return 'Invalid security debug token.'; } $expectedUrl = Hash::get($expectedParts, 0); $url = Hash::get($hashParts, 0); if ($expectedUrl !== $url) { $messages[] = sprintf('URL mismatch in POST data (expected \'%s\' but found \'%s\')', $expectedUrl, $url); } $expectedFields = Hash::get($expectedParts, 1); $dataFields = Hash::get($hashParts, 1); if ($dataFields) { $dataFields = unserialize($dataFields); } $fieldsMessages = $this->_debugCheckFields( $dataFields, $expectedFields, 'Unexpected field \'%s\' in POST data', 'Tampered field \'%s\' in POST data (expected value \'%s\' but found \'%s\')', 'Missing field \'%s\' in POST data' ); $expectedUnlockedFields = Hash::get($expectedParts, 2); $dataUnlockedFields = Hash::get($hashParts, 2) ?: null; if ($dataUnlockedFields) { $dataUnlockedFields = explode('|', $dataUnlockedFields); } $unlockFieldsMessages = $this->_debugCheckFields( (array)$dataUnlockedFields, $expectedUnlockedFields, 'Unexpected unlocked field \'%s\' in POST data', '', 'Missing unlocked field: \'%s\'' ); $messages = array_merge($messages, $fieldsMessages, $unlockFieldsMessages); return implode(', ', $messages); } /** * Iterates data array to check against expected * * @param array $dataFields Fields array, containing the POST data fields * @param array $expectedFields Fields array, containing the expected fields we should have in POST * @param string $intKeyMessage Message string if unexpected found in data fields indexed by int (not protected) * @param string $stringKeyMessage Message string if tampered found in * data fields indexed by string (protected). * @param string $missingMessage Message string if missing field * @return string[] Messages */ protected function _debugCheckFields( array $dataFields, array $expectedFields = [], string $intKeyMessage = '', string $stringKeyMessage = '', string $missingMessage = '' ): array { $messages = $this->_matchExistingFields($dataFields, $expectedFields, $intKeyMessage, $stringKeyMessage); $expectedFieldsMessage = $this->_debugExpectedFields($expectedFields, $missingMessage); if ($expectedFieldsMessage !== null) { $messages[] = $expectedFieldsMessage; } return $messages; } /** * Manually add form tampering prevention token information into the provided * request object. * * @param \Cake\Http\ServerRequest $request The request object to add into. * @return \Cake\Http\ServerRequest The modified request. */ public function generateToken(ServerRequest $request): ServerRequest { $token = [ 'unlockedFields' => $this->_config['unlockedFields'], ]; return $request->withAttribute('formTokenData', [ 'unlockedFields' => $token['unlockedFields'], ]); } /** * Calls a controller callback method * * @param \Cake\Controller\Controller $controller Instantiating controller * @param string $method Method to execute * @param array $params Parameters to send to method * @return mixed Controller callback method's response * @throws \Cake\Http\Exception\BadRequestException When a the blackholeCallback is not callable. */ protected function _callback(Controller $controller, string $method, array $params = []) { $callable = [$controller, $method]; if (!is_callable($callable)) { throw new BadRequestException('The request has been black-holed'); } return $callable(...$params); } /** * Generate array of messages for the existing fields in POST data, matching dataFields in $expectedFields * will be unset * * @param array $dataFields Fields array, containing the POST data fields * @param array $expectedFields Fields array, containing the expected fields we should have in POST * @param string $intKeyMessage Message string if unexpected found in data fields indexed by int (not protected) * @param string $stringKeyMessage Message string if tampered found in * data fields indexed by string (protected) * @return string[] Error messages */ protected function _matchExistingFields( array $dataFields, array &$expectedFields, string $intKeyMessage, string $stringKeyMessage ): array { $messages = []; foreach ($dataFields as $key => $value) { if (is_int($key)) { $foundKey = array_search($value, (array)$expectedFields, true); if ($foundKey === false) { $messages[] = sprintf($intKeyMessage, $value); } else { unset($expectedFields[$foundKey]); } } else { if (isset($expectedFields[$key]) && $value !== $expectedFields[$key]) { $messages[] = sprintf($stringKeyMessage, $key, $expectedFields[$key], $value); } unset($expectedFields[$key]); } } return $messages; } /** * Generate debug message for the expected fields * * @param array $expectedFields Expected fields * @param string $missingMessage Message template * @return string|null Error message about expected fields */ protected function _debugExpectedFields(array $expectedFields = [], string $missingMessage = ''): ?string { if (count($expectedFields) === 0) { return null; } $expectedFieldNames = []; foreach ((array)$expectedFields as $key => $expectedField) { if (is_int($key)) { $expectedFieldNames[] = $expectedField; } else { $expectedFieldNames[] = $key; } } return sprintf($missingMessage, implode(', ', $expectedFieldNames)); } }