SecurityToken
class SecurityToken implements TemplateGlobalProvider (View source)
Cross Site Request Forgery (CSRF) protection for the Form class and other GET links.
Can be used globally (through SecurityToken::inst()) or on a form-by-form basis Form->getSecurityToken().
Usage in forms
This protective measure is automatically turned on for all new Form instances, and can be globally disabled through disable().
Usage in custom controller actions
class MyController extends Controller {
function mygetaction($request) {
if(!SecurityToken::inst()->checkRequest($request)) return $this->httpError(400);
// valid action logic ...
}
}Traits
Provides extensions to this object to integrate it with standard config API methods.
A class that can be instantiated or replaced via DI
Properties
| protected static | string | $default_name | ||
| protected static | SecurityToken | $inst | ||
| protected static | bool | $enabled | ||
| protected | string | $name |
Methods
Get a configuration accessor for this class. Short hand for Config::inst()->get($this->class, .....).
Gets the uninherited value for the given config option
An implementation of the factory method, allows you to create an instance of a class
Creates a class instance by the "singleton" design pattern.
Globally disable the token (override with NullSecurityToken) implementation. Note: Does not apply for
Returns the value of an the global SecurityToken in the current session
Note: Doesn't call FormField->setForm() on the returned HiddenField, you'll need to take care of this yourself.
You can't disable an existing instance, it will need to be overwritten like this:
$old = SecurityToken::inst(); // isEnabled() returns true
SecurityToken::disable();
$new = SecurityToken::inst(); // isEnabled() returns falseCalled by SSViewer to get a list of global variables to expose to the template, the static method to call on this class to get the value for those variables, and the class to use for casting the returned value for use in a template
Details
static Config_ForClass
config()
Get a configuration accessor for this class. Short hand for Config::inst()->get($this->class, .....).
mixed
uninherited(string $name)
Gets the uninherited value for the given config option
static Injectable
create(mixed ...$args)
An implementation of the factory method, allows you to create an instance of a class
This method will defer class substitution to the Injector API, which can be customised via the Config API to declare substitution classes.
This can be called in one of two ways - either calling via the class directly, or calling on Object and passing the class name as the first parameter. The following are equivalent: $list = DataList::create(SiteTree::class); $list = SiteTree::get();
static Injectable
singleton(string $class = null)
Creates a class instance by the "singleton" design pattern.
It will always return the same instance for this class, which can be used for performance reasons and as a simple way to access instance methods which don't rely on instance data (e.g. the custom SilverStripe static handling).
__construct(string $name = null)
No description
static SecurityToken
inst()
Gets a global token (or creates one if it doesnt exist already).
static
disable()
Globally disable the token (override with NullSecurityToken) implementation. Note: Does not apply for
static
enable()
Globally enable tokens that have been previously disabled through disable.
static bool
is_enabled()
No description
static string
get_default_name()
No description
static int
getSecurityID()
Returns the value of an the global SecurityToken in the current session
setName(string $name)
No description
string
getName()
No description
string
getValue()
No description
$this
setValue(string $val)
No description
protected Session
getSession()
Returns the current session instance from the injector
reset()
Reset the token to a new value.
bool
check(string $compare)
Checks for an existing CSRF token in the current users session.
This check is automatically performed in Form->httpSubmission() if a form has security tokens enabled. This direct check is mainly used for URL actions on FormField that are not routed through Form->httpSubmission().
Typically you'll want to check Form->securityTokenEnabled() before calling this method.
bool
checkRequest(HTTPRequest $request)
See check().
protected string
getRequestToken(HTTPRequest $request)
Get security token from request
HiddenField|false
updateFieldSet(FieldList $fieldset)
Note: Doesn't call FormField->setForm() on the returned HiddenField, you'll need to take care of this yourself.
string
addToUrl(string $url)
No description
bool
isEnabled()
You can't disable an existing instance, it will need to be overwritten like this:
$old = SecurityToken::inst(); // isEnabled() returns true
SecurityToken::disable();
$new = SecurityToken::inst(); // isEnabled() returns false
protected string
generate()
No description
static array
get_template_global_variables()
Called by SSViewer to get a list of global variables to expose to the template, the static method to call on this class to get the value for those variables, and the class to use for casting the returned value for use in a template
If the method to call is not included for a particular template variable, a method named the same as the template variable will be called
If the casting class is not specified for a particular template variable, ViewableData::$default_cast is used
The first letter of the template variable is case-insensitive. However the method name is always case sensitive.