Cross-site request forgery (CSRF) Updated public function csrf_verify() { \/\/ If no POST data exists we will set the CSRF cookie if (count($_POST) == 0) { return $this->csrf_set_cookie(); } if((isset($_SERVER[‘HTTP_X_REQUESTED_WITH’]) && $_SERVER[‘HTTP_X_REQUESTED_WITH’] == “XMLHttpRequest”) || isset($_SERVER[‘HTTP_REFERER’])) { if(isset($_SERVER[‘HTTP_REFERER’])) { $parse_url = parse_url($_SERVER[‘HTTP_REFERER’]); if($parse_url[‘host’]!=$_SERVER[‘HTTP_HOST’] && !in_array($parse_url[‘host’], array(‘apps.facebook.com’))) { $this->csrf_show_error(); } else { \/\/echo ‘Safe’; \/\/echo ‘Host […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[34],"tags":[],"class_list":["post-911","post","type-post","status-publish","format-standard","hentry","category-codeigniter"],"acf":[],"yoast_head":"\npublic function csrf_verify()
\n{
\n\/\/ If no POST data exists we will set the CSRF cookie
\nif (count($_POST) == 0)
\n{
\nreturn $this->csrf_set_cookie();
\n}
\nif((isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == \"XMLHttpRequest\") || isset($_SERVER['HTTP_REFERER']))
\n{
\nif(isset($_SERVER['HTTP_REFERER']))
\n{
\n$parse_url = parse_url($_SERVER['HTTP_REFERER']);
\nif($parse_url['host']!=$_SERVER['HTTP_HOST'] && !in_array($parse_url['host'], array('apps.facebook.com')))
\n{
\n$this->csrf_show_error();
\n}
\nelse
\n{
\n\/\/echo 'Safe';
\n\/\/echo 'Host From: '.$parse_url['host'].'Host To: '.$_SERVER['HTTP_HOST'];
\n}
\n\/\/pre($parse_url);exit;
\n}
\n}
\nelse
\n{
\n\/\/ Do the tokens exist in both the _POST and _COOKIE arrays?
\nif(isset($_SERVER['HTTP_REFERER']))
\n{
\n$parse_url = parse_url($_SERVER['HTTP_REFERER']);
\nif($parse_url['host']!=$_SERVER['HTTP_HOST'] && !in_array($parse_url['host'], array('apps.facebook.com')))
\n{
\nif ( ! isset($_POST[$this->_csrf_token_name]) &&
\n! isset($_COOKIE[$this->_csrf_cookie_name]))
\n{
\n$this->csrf_show_error();
\n}
\n\/\/ Do the tokens match?
\nif (
\n(
\nisset($_POST[$this->_csrf_token_name])
\n&&
\nisset($_COOKIE[$this->_csrf_cookie_name])
\n)
\n&&
\n$_POST[$this->_csrf_token_name] != $_COOKIE[$this->_csrf_cookie_name])
\n{
\n$this->csrf_show_error();
\n}
\n}
\n}
\n\/\/ We kill this since we're done and we don't want to
\n\/\/ polute the _POST array
\nunset($_POST[$this->_csrf_token_name]);
\n\/\/ Nothing should last forever
\nunset($_COOKIE[$this->_csrf_cookie_name]);
\n$this->_csrf_set_hash();
\n$this->csrf_set_cookie();
\nlog_message('debug', \"CSRF token verified \");
\nreturn $this;
\n}
\n}
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"