class.ilCtrlTokenRepository.php

Go to the documentation of this file.

<?php

declare(strict_types=1);

/* Copyright (c) 2021 Thibeau Fuhrer <thf@studer-raimann.ch> Extended GPL, see docs/LICENSE */

class ilCtrlTokenRepository implements ilCtrlTokenRepositoryInterface
{
    public function getToken(): ilCtrlTokenInterface
    {
        $token = $this->fetchToken() ?? $this->generateToken();

        $this->storeToken($token);

        return $token;
    }

    protected function fetchToken(): ?ilCtrlTokenInterface
    {
        if (ilSession::has(ilCtrlInterface::PARAM_CSRF_TOKEN)) {
            return unserialize(ilSession::get(ilCtrlInterface::PARAM_CSRF_TOKEN), [ilCtrlTokenInterface::class]);
        }

        return null;
    }

    protected function storeToken(ilCtrlTokenInterface $token): void
    {
        ilSession::set(ilCtrlInterface::PARAM_CSRF_TOKEN, serialize($token));
    }

    protected function generateToken(): ilCtrlTokenInterface
    {
        // random_bytes() is cryptographically secure but
        // depends on the system it's running on. If the
        // generation fails, we use a less secure option
        // that is available for sure.

        try {
            $token = bin2hex(random_bytes(32));
        } catch (Throwable $t) {
            $token = md5(uniqid((string) time(), true));
        }

        return new ilCtrlToken($token);
    }
}