38 lines
1.5 KiB
PHP
38 lines
1.5 KiB
PHP
<?php
|
|
|
|
// if ($school_num == 20158 || $school_num == 3) startLog("ajax.csrfToken.php");
|
|
|
|
// if (!isset($csrf_token)) writeLog("Token Not Set");
|
|
if (array_key_exists('HTTP_X_CSRF_TOKEN', $_SERVER)) writeLog("_SERVER['HTTP_X_CSRF_TOKEN']: ".$_SERVER['HTTP_X_CSRF_TOKEN']);
|
|
if (array_key_exists('csrf_token', $_GET)) writeLog("_GET['csrf_token']: ".$_GET['csrf_token']);
|
|
if (array_key_exists('csrf_token', $_POST)) writeLog("_POST['csrf_token']: ".$_POST['csrf_token']);
|
|
|
|
|
|
// CSRF token validation
|
|
if (!isset($csrf_token) && array_key_exists('HTTP_X_CSRF_TOKEN',$_SERVER)) $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'];
|
|
if (!isset($csrf_token) && array_key_exists('csrf_token',$_GET)) $csrf_token = $_GET['csrf_token'];
|
|
if (!isset($csrf_token) && array_key_exists('csrf_token',$_POST)) $csrf_token = $_POST['csrf_token'];
|
|
|
|
// startLog("ajax.csrfToken.php");
|
|
if (!isset($csrf_token)) {
|
|
header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
|
|
logExit("csrf_token not set");
|
|
}
|
|
|
|
if (!array_key_exists('csrf_token',$_SESSION)) {
|
|
header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
|
|
logExit("CSRF SESSION Error");
|
|
exit();
|
|
}
|
|
|
|
if (!isset($csrf_token) || !isset($_SESSION['csrf_token']) || $csrf_token !== $_SESSION['csrf_token']) {
|
|
header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
|
|
logExit("CSRF Token Error");
|
|
exit();
|
|
}
|
|
|
|
writeLog("csrf_token: $csrf_token");
|
|
|
|
|
|
?>
|