CSRF form protection

• version: $Id: Hash.php 20096 2010-01-06 02:05:09Z bkarwin $
• copyright: Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)
• license: New BSD License

Located in /Form/Element/Hash.php (line 35)

Zend_Form_Element
   |
   --Zend_Form_Element_Xhtml
      |
      --Zend_Form_Element_Hash

string $helper = 'formHidden' (line 41)

Use formHidden view helper by default

• access: public

---

Redefinition of:

Zend_Form_Element::$helper

Default view helper to use

mixed $_hash (line 48)

Actual hash used.

• access: protected

string $_salt = 'salt' (line 54)

Salt for CSRF token

• access: protected

Zend_Session_Namespace $_session (line 59)

• access: protected

int $_timeout = 300 (line 65)

TTL for CSRF token

• access: protected

Inherited Variables

Inherited from Zend_Form_Element

Zend_Form_Element::$_allowEmpty
Zend_Form_Element::$_autoInsertNotEmptyValidator
Zend_Form_Element::$_belongsTo
Zend_Form_Element::$_decorators
Zend_Form_Element::$_description
Zend_Form_Element::$_disableLoadDefaultDecorators
Zend_Form_Element::$_errorMessages
Zend_Form_Element::$_errorMessageSeparator
Zend_Form_Element::$_errors
Zend_Form_Element::$_filters
Zend_Form_Element::$_ignore
Zend_Form_Element::$_isArray
Zend_Form_Element::$_isError
Zend_Form_Element::$_isErrorForced
Zend_Form_Element::$_isPartialRendering
Zend_Form_Element::$_label
Zend_Form_Element::$_loaders
Zend_Form_Element::$_messages
Zend_Form_Element::$_name
Zend_Form_Element::$_order
Zend_Form_Element::$_required
Zend_Form_Element::$_translator
Zend_Form_Element::$_translatorDisabled
Zend_Form_Element::$_type
Zend_Form_Element::$_validatorRules
Zend_Form_Element::$_validators
Zend_Form_Element::$_value
Zend_Form_Element::$_view

Constructor __construct (line 77)

Constructor

Creates session namespace for CSRF token, and adds validator for CSRF token.

• access: public

void __construct (string|array|Zend_Config $spec, [array|Zend_Config $options = null])

• string|array|Zend_Config $spec
• array|Zend_Config $options

---

Redefinition of:

Zend_Form_Element::__construct()

Constructor

getHash (line 164)

Retrieve CSRF token

If no CSRF token currently exists, generates one.

• access: public

string getHash ()

getLabel (line 211)

Override getLabel() to always be empty

• access: public

null getLabel ()

---

Redefinition of:

Zend_Form_Element::getLabel()

Retrieve element label

getSalt (line 152)

Retrieve salt for CSRF token

• access: public

string getSalt ()

getSession (line 105)

Get session object

Instantiate session object if none currently exists

• access: public

Zend_Session_Namespace getSession ()

getSessionName (line 179)

Get session namespace for CSRF token

Generates a session namespace based on salt, element name, and class.

• access: public

string getSessionName ()

getTimeout (line 201)

Get CSRF session token timeout

• access: public

int getTimeout ()

initCsrfToken (line 221)

Initialize CSRF token in session

• access: public

void initCsrfToken ()

initCsrfValidator (line 122)

Initialize CSRF validator

Creates Session namespace, and initializes CSRF token in session. Additionally, adds validator for validating CSRF token.

• access: public

Zend_Form_Element_Hash initCsrfValidator ()

render (line 235)

Render CSRF token in form

• access: public

string render ([ $view = null])

• Zend_View_Interface $view

---

Redefinition of:

Zend_Form_Element::render()

Render form element

setSalt (line 141)

Salt for CSRF token

• access: public

Zend_Form_Element_Hash setSalt (string $salt)

• string $salt

setSession (line 92)

Set session object

• access: public

Zend_Form_Element_Hash setSession (Zend_Session_Namespace $session)

• Zend_Session_Namespace $session

setTimeout (line 190)

Set timeout for CSRF session token

• access: public

Zend_Form_Element_Hash setTimeout (int $ttl)

• int $ttl

_generateHash (line 249)

Generate CSRF token

Generates CSRF token and stores both in $_hash and element value.

• access: protected

void _generateHash ()

Inherited Methods

Inherited From Zend_Form_Element

Zend_Form_Element::__construct()
Zend_Form_Element::addDecorator()
Zend_Form_Element::addDecorators()
Zend_Form_Element::addError()
Zend_Form_Element::addErrorMessage()
Zend_Form_Element::addErrorMessages()
Zend_Form_Element::addErrors()
Zend_Form_Element::addFilter()
Zend_Form_Element::addFilters()
Zend_Form_Element::addPrefixPath()
Zend_Form_Element::addPrefixPaths()
Zend_Form_Element::addValidator()
Zend_Form_Element::addValidators()
Zend_Form_Element::autoInsertNotEmptyValidator()
Zend_Form_Element::clearDecorators()
Zend_Form_Element::clearErrorMessages()
Zend_Form_Element::clearFilters()
Zend_Form_Element::clearValidators()
Zend_Form_Element::filterName()
Zend_Form_Element::getAllowEmpty()
Zend_Form_Element::getAttrib()
Zend_Form_Element::getAttribs()
Zend_Form_Element::getBelongsTo()
Zend_Form_Element::getDecorator()
Zend_Form_Element::getDecorators()
Zend_Form_Element::getDescription()
Zend_Form_Element::getErrorMessages()
Zend_Form_Element::getErrorMessageSeparator()
Zend_Form_Element::getErrors()
Zend_Form_Element::getFilter()
Zend_Form_Element::getFilters()
Zend_Form_Element::getFullyQualifiedName()
Zend_Form_Element::getId()
Zend_Form_Element::getIgnore()
Zend_Form_Element::getLabel()
Zend_Form_Element::getMessages()
Zend_Form_Element::getName()
Zend_Form_Element::getOrder()
Zend_Form_Element::getPluginLoader()
Zend_Form_Element::getTranslator()
Zend_Form_Element::getType()
Zend_Form_Element::getUnfilteredValue()
Zend_Form_Element::getValidator()
Zend_Form_Element::getValidators()
Zend_Form_Element::getValue()
Zend_Form_Element::getView()
Zend_Form_Element::hasErrors()
Zend_Form_Element::hasTranslator()
Zend_Form_Element::init()
Zend_Form_Element::isArray()
Zend_Form_Element::isRequired()
Zend_Form_Element::isValid()
Zend_Form_Element::loadDefaultDecorators()
Zend_Form_Element::loadDefaultDecoratorsIsDisabled()
Zend_Form_Element::markAsError()
Zend_Form_Element::removeDecorator()
Zend_Form_Element::removeFilter()
Zend_Form_Element::removeValidator()
Zend_Form_Element::render()
Zend_Form_Element::setAllowEmpty()
Zend_Form_Element::setAttrib()
Zend_Form_Element::setAttribs()
Zend_Form_Element::setAutoInsertNotEmptyValidator()
Zend_Form_Element::setBelongsTo()
Zend_Form_Element::setConfig()
Zend_Form_Element::setDecorators()
Zend_Form_Element::setDescription()
Zend_Form_Element::setDisableLoadDefaultDecorators()
Zend_Form_Element::setDisableTranslator()
Zend_Form_Element::setErrorMessages()
Zend_Form_Element::setErrorMessageSeparator()
Zend_Form_Element::setErrors()
Zend_Form_Element::setFilters()
Zend_Form_Element::setIgnore()
Zend_Form_Element::setIsArray()
Zend_Form_Element::setLabel()
Zend_Form_Element::setName()
Zend_Form_Element::setOptions()
Zend_Form_Element::setOrder()
Zend_Form_Element::setPluginLoader()
Zend_Form_Element::setRequired()
Zend_Form_Element::setTranslator()
Zend_Form_Element::setValidators()
Zend_Form_Element::setValue()
Zend_Form_Element::setView()
Zend_Form_Element::translatorIsDisabled()
Zend_Form_Element::_filterValue()
Zend_Form_Element::_getDecorator()
Zend_Form_Element::_getErrorMessages()
Zend_Form_Element::_hasErrorMessages()
Zend_Form_Element::_loadDecorator()
Zend_Form_Element::_loadFilter()
Zend_Form_Element::_loadValidator()
Zend_Form_Element::__call()
Zend_Form_Element::__get()
Zend_Form_Element::__set()
Zend_Form_Element::__toString()

Inherited Constants

Inherited from Zend_Form_Element

Zend_Form_Element::DECORATOR
Zend_Form_Element::FILTER
Zend_Form_Element::VALIDATE