class SecurityToken implements TemplateGlobalProvider (View source)

Cross Site Request Forgery (CSRF) protection for the {@link Form} class and other GET links.

Can be used globally (through {@link SecurityToken::inst()}) or on a form-by-form basis {@link Form->getSecurityToken()}.

Usage in forms

This protective measure is automatically turned on for all new {@link Form} instances, and can be globally disabled through {@link disable()}.

Usage in custom controller actions

class MyController extends Controller { function mygetaction($request) { if(!SecurityToken::inst()->checkRequest($request)) return $this->httpError(400);

 // valid action logic ...

} }

Traits

Provides extensions to this object to integrate it with standard config API methods.

A class that can be instantiated or replaced via DI

Methods

static Config_ForClass
config()

Get a configuration accessor for this class. Short hand for Config::inst()->get($this->class, .....).

mixed
stat(string $name) deprecated

Get inherited config value

mixed
uninherited(string $name)

Gets the uninherited value for the given config option

$this
set_stat(string $name, mixed $value) deprecated

Update the config value for a given property

static Injectable
create(array ...$args)

An implementation of the factory method, allows you to create an instance of a class

static Injectable
singleton(string $class = null)

Creates a class instance by the "singleton" design pattern.

__construct(string $name = null)

No description

static SecurityToken
inst()

Gets a global token (or creates one if it doesnt exist already).

static 
disable()

Globally disable the token (override with {@link NullSecurityToken}) implementation. Note: Does not apply for

static 
enable()

Globally enable tokens that have been previously disabled through {@link disable}.

static bool
is_enabled()

No description

static string
get_default_name()

No description

static int
getSecurityID()

Returns the value of an the global SecurityToken in the current session

setName(string $name)

No description

string
getName()

No description

string
getValue()

No description

$this
setValue(string $val)

No description

reset()

Reset the token to a new value.

bool
check(string $compare)

Checks for an existing CSRF token in the current users session.

bool
checkRequest(HTTPRequest $request)

See {@link check()}.

HiddenField|false
updateFieldSet(FieldList $fieldset)

Note: Doesn't call {@link FormField->setForm()} on the returned {@link HiddenField}, you'll need to take care of this yourself.

string
addToUrl(string $url)

No description

bool
isEnabled()

You can't disable an existing instance, it will need to be overwritten like this: $old = SecurityToken::inst(); // isEnabled() returns true SecurityToken::disable(); $new = SecurityToken::inst(); // isEnabled() returns false

static array
get_template_global_variables()

Called by SSViewer to get a list of global variables to expose to the template, the static method to call on this class to get the value for those variables, and the class to use for casting the returned value for use in a template

Details

static Config_ForClass config()

Get a configuration accessor for this class. Short hand for Config::inst()->get($this->class, .....).

Return Value

Config_ForClass

mixed stat(string $name) deprecated

deprecated 5.0 Use ->config()->get() instead

Get inherited config value

Parameters

string $name

Return Value

mixed

mixed uninherited(string $name)

Gets the uninherited value for the given config option

Parameters

string $name

Return Value

mixed

$this set_stat(string $name, mixed $value) deprecated

deprecated 5.0 Use ->config()->set() instead

Update the config value for a given property

Parameters

string $name
mixed $value

Return Value

$this

static Injectable create(array ...$args)

An implementation of the factory method, allows you to create an instance of a class

This method will defer class substitution to the Injector API, which can be customised via the Config API to declare substitution classes.

This can be called in one of two ways - either calling via the class directly, or calling on Object and passing the class name as the first parameter. The following are equivalent: $list = DataList::create('SiteTree'); $list = SiteTree::get();

Parameters

array ...$args

Return Value

Injectable

static Injectable singleton(string $class = null)

Creates a class instance by the "singleton" design pattern.

It will always return the same instance for this class, which can be used for performance reasons and as a simple way to access instance methods which don't rely on instance data (e.g. the custom SilverStripe static handling).

Parameters

string $class

Optional classname to create, if the called class should not be used

Return Value

Injectable

The singleton instance

__construct(string $name = null)

Parameters

string $name

static SecurityToken inst()

Gets a global token (or creates one if it doesnt exist already).

Return Value

SecurityToken

static disable()

Globally disable the token (override with {@link NullSecurityToken}) implementation. Note: Does not apply for

static enable()

Globally enable tokens that have been previously disabled through {@link disable}.

static bool is_enabled()

Return Value

bool

static string get_default_name()

Return Value

string

static int getSecurityID()

Returns the value of an the global SecurityToken in the current session

Return Value

int

setName(string $name)

Parameters

string $name

string getName()

Return Value

string

string getValue()

Return Value

string

$this setValue(string $val)

Parameters

string $val

Return Value

$this

reset()

Reset the token to a new value.

bool check(string $compare)

Checks for an existing CSRF token in the current users session.

This check is automatically performed in {@link Form->httpSubmission()} if a form has security tokens enabled. This direct check is mainly used for URL actions on {@link FormField} that are not routed through {@link Form->httpSubmission()}.

Typically you'll want to check {@link Form->securityTokenEnabled()} before calling this method.

Parameters

string $compare

Return Value

bool

bool checkRequest(HTTPRequest $request)

See {@link check()}.

Parameters

HTTPRequest $request

Return Value

bool

HiddenField|false updateFieldSet(FieldList $fieldset)

Note: Doesn't call {@link FormField->setForm()} on the returned {@link HiddenField}, you'll need to take care of this yourself.

Parameters

FieldList $fieldset

Return Value

HiddenField|false

string addToUrl(string $url)

Parameters

string $url

Return Value

string

bool isEnabled()

You can't disable an existing instance, it will need to be overwritten like this: $old = SecurityToken::inst(); // isEnabled() returns true SecurityToken::disable(); $new = SecurityToken::inst(); // isEnabled() returns false

Return Value

bool

static array get_template_global_variables()

Called by SSViewer to get a list of global variables to expose to the template, the static method to call on this class to get the value for those variables, and the class to use for casting the returned value for use in a template

If the method to call is not included for a particular template variable, a method named the same as the template variable will be called

If the casting class is not specified for a particular template variable, ViewableData::$default_cast is used

The first letter of the template variable is case-insensitive. However the method name is always case sensitive.

Return Value

array

Returns an array of items. Each key => value pair is one of three forms:

  • template name (no key)
  • template name => method name
  • template name => [], where the array can contain these key => value pairs
    • "method" => method name
    • "casting" => casting class to use (i.e., Varchar, HTMLFragment, etc)