1. class
  2. SilverStripe
  3. \
  4. Security
  5. \
  6. SecurityToken

SecurityToken

class SecurityToken implements TemplateGlobalProvider

Cross Site Request Forgery (CSRF) protection for the {@link Form} class and other GET links.

Can be used globally (through {@link SecurityToken::inst()}) or on a form-by-form basis {@link Form->getSecurityToken()}.

Usage in forms

This protective measure is automatically turned on for all new {@link Form} instances, and can be globally disabled through {@link disable()}.

Usage in custom controller actions

class MyController extends Controller { function mygetaction($request) { if(!SecurityToken::inst()->checkRequest($request)) return $this->httpError(400);

 // valid action logic ...

} }

Traits

Configurable
Provides extensions to this object to integrate it with standard config API methods.
Injectable
A class that can be instantiated or replaced via DI

Methods

static Config_ForClass
config()

Get a configuration accessor for this class. Short hand for Config::inst()->get($this->class, .

from Configurable
mixed
stat(string $name) deprecated

Get inherited config value

from Configurable
mixed
uninherited(string $name)

Gets the uninherited value for the given config option

from Configurable
$this
set_stat(string $name, mixed $value) deprecated

Update the config value for a given property

from Configurable
static Injectable
create(array $args)

An implementation of the factory method, allows you to create an instance of a class

from Injectable
static Injectable
singleton(string $class = null)

Creates a class instance by the "singleton" design pattern.

from Injectable
__construct(string $name = null)

No description

static SecurityToken
inst()

Gets a global token (or creates one if it doesnt exist already).

static 
disable()

Globally disable the token (override with {@link NullSecurityToken}) implementation. Note: Does not apply for

static 
enable()

Globally enable tokens that have been previously disabled through {@link disable}.

static boolean
is_enabled()

No description

static string
get_default_name()

No description

static int
getSecurityID()

Returns the value of an the global SecurityToken in the current session

setName(string $name)

No description

string
getName()

No description

string
getValue()

No description

$this
setValue(string $val)

No description

reset()

Reset the token to a new value.

boolean
check(string $compare)

Checks for an existing CSRF token in the current users session.

bool
checkRequest(HTTPRequest $request)

See {@link check()}.

HiddenField|false
updateFieldSet(FieldList $fieldset)

Note: Doesn't call {@link FormField->setForm()} on the returned {@link HiddenField}, you'll need to take care of this yourself.

string
addToUrl(string $url)

No description

boolean
isEnabled()

You can't disable an existing instance, it will need to be overwritten like this: $old = SecurityToken::inst(); // isEnabled() returns true SecurityToken::disable(); $new = SecurityToken::inst(); // isEnabled() returns false

static array
get_template_global_variables()

Called by SSViewer to get a list of global variables to expose to the template, the static method to call on this class to get the value for those variables, and the class to use for casting the returned value for use in a template

Details

in Configurable at line 20
static Config_ForClass config()

Get a configuration accessor for this class. Short hand for Config::inst()->get($this->class, .

....).

Return Value

Config_ForClass

in Configurable at line 32
mixed stat(string $name) deprecated

deprecated 5.0 Use ->config()->get() instead

Get inherited config value

Parameters

string $name

Return Value

mixed

in Configurable at line 44
mixed uninherited(string $name)

Gets the uninherited value for the given config option

Parameters

string $name

Return Value

mixed

in Configurable at line 57
$this set_stat(string $name, mixed $value) deprecated

deprecated 5.0 Use ->config()->set() instead

Update the config value for a given property

Parameters

string $name
mixed $value

Return Value

$this

in Injectable at line 26
static Injectable create(array $args)

An implementation of the factory method, allows you to create an instance of a class

This method will defer class substitution to the Injector API, which can be customised via the Config API to declare substitution classes.

This can be called in one of two ways - either calling via the class directly, or calling on Object and passing the class name as the first parameter. The following are equivalent: $list = DataList::create('SiteTree'); $list = SiteTree::get();

Parameters

array $args

Return Value

Injectable

in Injectable at line 43
static Injectable singleton(string $class = null)

Creates a class instance by the "singleton" design pattern.

It will always return the same instance for this class, which can be used for performance reasons and as a simple way to access instance methods which don't rely on instance data (e.g. the custom SilverStripe static handling).

Parameters

string $class Optional classname to create, if the called class should not be used

Return Value

Injectable The singleton instance

at line 68
__construct(string $name = null)

Parameters

string $name

at line 78
static SecurityToken inst()

Gets a global token (or creates one if it doesnt exist already).

Return Value

SecurityToken

at line 91
static disable()

Globally disable the token (override with {@link NullSecurityToken}) implementation. Note: Does not apply for

at line 100
static enable()

Globally enable tokens that have been previously disabled through {@link disable}.

at line 109
static boolean is_enabled()

Return Value

boolean

at line 117
static string get_default_name()

Return Value

string

at line 126
static int getSecurityID()

Returns the value of an the global SecurityToken in the current session

Return Value

int

at line 135
setName(string $name)

Parameters

string $name

at line 145
string getName()

Return Value

string

at line 153
string getValue()

Return Value

string

at line 171
$this setValue(string $val)

Parameters

string $val

Return Value

$this

at line 197
reset()

Reset the token to a new value.

at line 214
boolean check(string $compare)

Checks for an existing CSRF token in the current users session.

This check is automatically performed in {@link Form->httpSubmission()} if a form has security tokens enabled. This direct check is mainly used for URL actions on {@link FormField} that are not routed through {@link Form->httpSubmission()}.

Typically you'll want to check {@link Form->securityTokenEnabled()} before calling this method.

Parameters

string $compare

Return Value

boolean

at line 225
bool checkRequest(HTTPRequest $request)

See {@link check()}.

Parameters

HTTPRequest $request

Return Value

bool

at line 257
HiddenField|false updateFieldSet(FieldList $fieldset)

Note: Doesn't call {@link FormField->setForm()} on the returned {@link HiddenField}, you'll need to take care of this yourself.

Parameters

FieldList $fieldset

Return Value

HiddenField|false

at line 272
string addToUrl(string $url)

Parameters

string $url

Return Value

string

at line 287
boolean isEnabled()

You can't disable an existing instance, it will need to be overwritten like this: $old = SecurityToken::inst(); // isEnabled() returns true SecurityToken::disable(); $new = SecurityToken::inst(); // isEnabled() returns false

Return Value

boolean

at line 303
static array get_template_global_variables()

Called by SSViewer to get a list of global variables to expose to the template, the static method to call on this class to get the value for those variables, and the class to use for casting the returned value for use in a template

If the method to call is not included for a particular template variable, a method named the same as the template variable will be called

If the casting class is not specified for a particular template variable, ViewableData::$default_cast is used

The first letter of the template variable is case-insensitive. However the method name is always case sensitive.

Return Value

array Returns an array of items. Each key => value pair is one of three forms: - template name (no key) - template name => method name - template name => array(), where the array can contain these key => value pairs - "method" => method name - "casting" => casting class to use (i.e., Varchar, HTMLFragment, etc)