Proyectos de Subversion LeadersLinked - Services

Rev

Rev 67 | Rev 99 | Ir a la última revisión | Mostrar el archivo completo | | | Autoría | Ultima modificación | Ver Log |

Rev 67 Rev 95
Línea 1646... Línea 1646...
1646 
 
 1646 
 
1647 
    public function csrfAction()
 1647 
    public function csrfAction()
1648 
    {
 1648 
    {
1649 
        $request = $this->getRequest();
 1649 
        $request = $this->getRequest();
- 
 
 1650 
        if ($request->isGet()) {
- 
 
 1651
- 
 
 1652 
            $jwtToken = null;
- 
 
 1653 
            $headers = getallheaders();
- 
 
 1654
- 
 
 1655
- 
 
 1656 
            if(!empty($headers['authorization']) || !empty($headers['Authorization'])) {
- 
 
 1657
- 
 
 1658 
                $token = trim(empty($headers['authorization']) ? $headers['Authorization'] : $headers['authorization']);
- 
 
 1659
- 
 
 1660
- 
 
 1661 
                if (substr($token, 0, 6 ) == 'Bearer') {
- 
 
 1662
- 
 
 1663 
                    $token = trim(substr($token, 7));
- 
 
 1664
- 
 
 1665 
                    if(!empty($this->config['leaderslinked.jwt.key'])) {
- 
 
 1666 
                        $key = $this->config['leaderslinked.jwt.key'];
- 
 
 1667
- 
 
 1668
- 
 
 1669 
                        try {
- 
 
 1670 
                            $payload = JWT::decode($token, new Key($key, 'HS256'));
- 
 
 1671
- 
 
 1672
- 
 
 1673 
                            if(empty($payload->iss) || $payload->iss != $_SERVER['HTTP_HOST']) {
- 
 
 1674 
                                return new JsonModel(['success' => false, 'data' => 'Unauthorized - JWT - Wrong server',  'fatal'  => true]);
- 
 
 1675 
                            }
- 
 
 1676
- 
 
 1677 
                            $uuid = empty($payload->uuid) ? '' : $payload->uuid;
- 
 
 1678 
                            $jwtTokenMapper = JwtTokenMapper::getInstance($this->adapter);
- 
 
 1679 
                            $jwtToken = $jwtTokenMapper->fetchOneByUuid($uuid);
- 
 
 1680 
                            if(!$jwtToken) {
- 
 
 1681 
                                return new JsonModel(['success' => false, 'data' => 'Unauthorized - JWT - Expired',  'fatal'  => true]);
- 
 
 1682 
                            }
- 
 
 1683
- 
 
 1684 
                        } catch(\Exception $e) {
- 
 
 1685 
                            return new JsonModel(['success' => false, 'data' => 'Unauthorized - JWT - Wrong key',  'fatal'  => true]);
- 
 
 1686 
                        }
- 
 
 1687 
                    } else {
- 
 
 1688 
                        return new JsonModel(['success' => false, 'data' => 'Unauthorized - JWT - SecreteKey required',  'fatal'  => true]);
- 
 
 1689 
                    }
- 
 
 1690 
                } else {
- 
 
 1691 
                    return new JsonModel(['success' => false, 'data' => 'Unauthorized - JWT - Bearer required',  'fatal'  => true]);
- 
 
 1692 
                }
- 
 
 1693 
            } else {
- 
 
 1694 
                return new JsonModel(['success' => false, 'data' => 'Unauthorized - JWT - Required',  'fatal'  => true]);
1650 
        if ($request->isGet()) {
 1695 
            }
1651 
 
 1696
- 
 
 1697 
            $jwtToken->csrf = md5(uniqid('CSFR-' . mt_rand(), true));
1652 
            $token = md5(uniqid('CSFR-' . mt_rand(), true));
 1698 
            $jwtTokenMapper = JwtTokenMapper::getInstance($this->adapter);
Línea 1653... Línea 1699...
1653 
            $_SESSION['token'] = $token;
 1699 
            $jwtTokenMapper->update($jwtToken);
1654 
 
 1700 
 
1655 
 
 1701