nextras / secured-links Goto Github PK

nette/application#246

For obvious reasons I get this error:

Recoverable Error
Object of class ... could not be converted to string

For now I'm using this workaround:

    use SecuredLinksPresenterTrait {
        getCsrfToken as private traitGetCsrfToken;
    }

    public function getCsrfToken($control, $method, $params)
    {
        array_walk($params, function (&$value) {
            if (is_object($value)) {
                $value = spl_object_hash($value);
            }
        });
        return $this->traitGetCsrfToken($control, $method, $params);
    }

Should I send a PR with this change or are you against it?

It seems that only signals can be protected. But I usually use render or action methods for actions which should be protected (e.g. renderDelete).

Hello, what about nette 3.0 supports?

We currently use in are app ugly workaround

$params = array_map(
	function ($param) {
		return is_object($param) && method_exists($param, 'getId') ? $param->getId() : $param;
	},
	$params
);

I would like to set a custom expiration for session section. I can do it by myself, but it would by nice to have some handy function for this. Something like:

public function setExpiration($expiration)
{
    $section = $this->getSession('Nextras.Application.UI.SecuredLinksPresenterTrait');
    $section->setExpiration($expiration);
}

PHP Warning: Declaration of Nextras\Application\UI\SecuredLinksPresenterTrait::link(string $destination, $args = Array): string should be compatible with Nette\Application\UI\Component::link(string $destination, ...$args): string

nette/application@a987d58

Can you please create a new release of the package? In particular, I need nette/utils version 4 to be in the new release, i.e., the following commit c5a0137. Thanks a lot.

Verify that http://breachattack.com/ does not affect this library is that is is properly mitigated.

Function random_bytes from paragonie/random_compat library can throw an exception. It is very rare situation, but it really happens on our production server. I suggest to encapsulate this code:

$session->token = function_exists('random_bytes')
    ? random_bytes(16)
    : Nette\Utils\Random::generate(16, "\x00-\xFF");

to try/catch block. In catch will be Random::generate()

Tento PR #31 co se dělal pro verzi 3.1.4 nefunguje na verzi 3.1.5 https://github.com/nette/application/releases/tag/v3.1.5.
Vypadá že tam někdo reportoval že to byl asi BC break tak se to vrátilo do stavu jak to bylo před verzí 3.1.4.

Nevím zda by stačil revert toho PR pouze nebo už není žádoucí vracet PHP 7.1.

Annotation /** @secured*/ silently fails.

See the same issue as nette/forms#36 on CsrfProtection on Nette Forms.

It is maybe possible to use Length extension attack against secured-links. I don't have now time to study and verify whether this is true or not.

If the attack is proven to be feasible, we should use HMAC instead of plain MD5.

Another enhancement to consider: after signal is processed, it's token could by invalidated. This can be achieved by removing token stored in session.

This library declares compatibility with PHP ^7.2 in composer.json. However, release 1.10.0 requires PHP 8.0. because it uses ReflectionClass::getAttributes() method.

see this commit: 752ad93

Hi, can you release tagged version for Nette 3, please? Thank you.

I keep receiving "Invalid token" error messages when signal parameter is called $order.

protected function handleSetOrder($order);

Kde to pouziva Nette/Utils? Koukal jsem do src, ale bud jsem slepej a nebo jsem to v hlavicce nikde nenasel?
Pokud nejsem slepej, tak vyhodit z composer.json?