";
foreach ($fieldsVerify as $field)
{
if (!isset ($field->verify))
continue;
if (!isset ($valuesVerify[$field->name]))
throw new Exception ("No value provided for $field->name", 500);
foreach ($field->verify as $test => $message)
{
$func = sprintf ($test, addslashes ($valuesVerify[$field->name]));
if ($this->debug)
echo "VERIFY: \"$func\" => ";
$tmpfield = $field;
$res = addslashes (serialize ($tmpfield));
// TODO : http://fr2.php.net/manual/en/reflectionfunction.invokeargs.php
// to remove eval ?
$rc = eval ("\$tmpfield=unserialize(stripslashes('$res'));".
"return $func;");
if ($this->debug)
var_dump ($rc);
if ($rc !== FALSE)
{
$ret[$field->name] = $message;
$field->error = $message;
break;
}
}
}
if ($this->debug)
{
echo "RESULT: ";
var_dump ($ret);
echo "";
}
return $ret;
}
/** Return the fields in HTML code. If $values is provided, use it in place
of default values. In case of select boxes, $values are the selected
elements
$method is the method written in method field of \n";
return $res;
}
/** Check the token from the user
@param string $tokenFromUser The value form the user's token */
public function checkToken ($tokenFromUser)
{
$csrf = new csrf ();
$csrf->field = $this->csrfField;
$csrf->checkToken ($tokenFromUser);
}
}
/** the definition of a formfield */
class formfield
{
/** The name of the field */
public $name;
/** The label of the field */
public $label;
/** The titles of the field */
public $titles;
/** The defaults values of the field */
public $defaults;
/** The type of the field (text, password, checkbox, select)*/
public $type;
/** The multiplicity of selection of the field (available in select only)*/
public $multiple;
/** The name of group for the fields */
public $group;
/** The read-only feature of the field */
public $readonly;
/** The fonction used to verify the field by AJAX before submitting and
by PHP after submission*/
public $verify;
/** The statut of error of the field */
public $error;
/** When adding a field, the name and the label are the minimum mandatory
@param string $name Name of the field
@param string $label Label of the field */
function __construct ($name, $label)
{
$this->name = $name;
$this->label = $label;
}
}
/** CSRF protection
By default, the CSRF protection is active if a SESSION is active too.
It can be disabled if needed. An Exception is raised if the form is send
back without the token */
class csrf
{
/** Allow to disable the csrf protection */
public $csrf=TRUE;
/** This hidden field name in HTML */
public $field = "CSRF_TOKEN";
/** The created token */
private $csrfToken = "";
/** Timeout of the CSRF token : 3600s by default (maximum time allowed to
enter information in form and submit) */
private $csrfTimeout = 3600;
/** This function return the token */
public function createToken ()
{
$l = 30; // Number of chars in token
$c = "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ";
for ($s = '',
$cl = strlen($c)-1, $i = 0; $i < $l; $s .= $c[mt_rand(0, $cl)],
++$i);
$this->csrfToken = $s;
$_SESSION["domframework"]["form"]["csrf"] = $this->csrfToken;
$_SESSION["domframework"]["form"]["csrfStart"] = microtime (TRUE);
}
/** Check if the provided token is the right token, defined last displayed
page
@param string $tokenFromUser The value form the user's token */
public function checkToken ($tokenFromUser)
{
if ($this->csrf === FALSE )
return TRUE;
if (! isset ($_SESSION["domframework"]["form"]["csrf"]))
throw new Exception (_("No previous CSRF token : abort"));
if ($_SESSION["domframework"]["form"]["csrf"] !== $tokenFromUser)
throw new Exception (_("Invalid CSRF token provided"));
if (($_SESSION["domframework"]["form"]["csrfStart"] + $this->csrfTimeout) <
microtime (TRUE))
throw new Exception (_("Obsolete CSRF token provided"));
return TRUE;
}
/** Return the CSRF token in a hidden field */
public function displayFormCSRF ()
{
if ($this->csrfToken == "")
$this->createToken ();
$res = "