3 * MediaWiki session token
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
24 namespace MediaWiki\Session
;
27 * Value object representing a CSRF token
33 /** CSRF token suffix. Plus and terminal backslash are included to stop
34 * editing from certain broken proxies. */
42 * @param string $secret Token secret
43 * @param string $salt Token salt
44 * @param bool $new Whether the secret was newly-created
46 public function __construct( $secret, $salt, $new = false ) {
47 $this->secret
= $secret;
53 * Decode the timestamp from a token string
55 * Does not validate the token beyond the syntactic checks necessary to
56 * be able to extract the timestamp.
58 * @param string $token
61 public static function getTimestamp( $token ) {
62 $suffixLen = strlen( self
::SUFFIX
);
63 $len = strlen( $token );
64 if ( $len <= 32 +
$suffixLen ||
65 substr( $token, -$suffixLen ) !== self
::SUFFIX ||
66 strspn( $token, '0123456789abcdef' ) +
$suffixLen !== $len
71 return hexdec( substr( $token, 32, -$suffixLen ) );
75 * Get the string representation of the token at a timestamp
76 * @param int timestamp
79 protected function toStringAtTimestamp( $timestamp ) {
80 return hash_hmac( 'md5', $timestamp . $this->salt
, $this->secret
, false ) .
81 dechex( $timestamp ) .
86 * Get the string representation of the token
89 public function toString() {
90 return $this->toStringAtTimestamp( wfTimestamp() );
93 public function __toString() {
94 return $this->toString();
98 * Test if the token-string matches this token
99 * @param string $userToken
100 * @param int|null $maxAge Return false if $userToken is older than this many seconds
103 public function match( $userToken, $maxAge = null ) {
104 $timestamp = self
::getTimestamp( $userToken );
105 if ( $timestamp === null ) {
108 if ( $maxAge !== null && $timestamp < wfTimestamp() - $maxAge ) {
113 $sessionToken = $this->toStringAtTimestamp( $timestamp );
114 return hash_equals( $sessionToken, $userToken );
118 * Indicate whether this token was just created
121 public function wasNew() {