Merge branch 'master' of https://github.com/unaio/una

inc/classes/BxDolForm.php

@@ -1105,7 +1105,7 @@ class BxDolForm extends BxDol implements iBxDolReplaceable
         if (!($oKeys = BxDolKey::getInstance()))
             return false;
 
-        return $oKeys->getNewKey (false, (int)getParam('sys_security_form_token_lifetime'));
+        return $oKeys->getNewKey (false, (int)getParam('sys_security_form_token_lifetime'), $_SERVER['REMOTE_ADDR']);
     }
     
     public static function isCsrfTokenValid($s)
@@ -1117,8 +1117,9 @@ class BxDolForm extends BxDol implements iBxDolReplaceable
             return true;
 
         if ($oKeys->isKeyExists($s)) {
+            $bRet = $oKeys->isKeyExists($s, $_SERVER['REMOTE_ADDR']);
             $oKeys->removeKey($s);
-            return true;
+            return $bRet;
         }
         return false;
     }

inc/classes/BxDolKey.php

@@ -72,10 +72,10 @@ class BxDolKey extends BxDolFactory implements iBxDolSingleton
      * @param $iExpire - number of seconds to generated key after, by default - 1 week
      * @return newly generated key string
      */
-    public function getNewKey ($aData = false, $iExpire = 604800)
+    public function getNewKey ($aData = false, $iExpire = 604800, $sSalt = '')
     {
-        $sKey = md5(time() . rand() . BX_DOL_SECRET);
-        if ($this->_oQuery->insert($sKey, $aData ? serialize($aData) : '', (int)$iExpire));
+        $sKey = md5(time() . rand() . BX_DOL_SECRET . $sSalt);
+        if ($this->_oQuery->insert($sKey, $aData ? serialize($aData) : '', (int)$iExpire, $sSalt));
             return $sKey;
         return false;
     }
@@ -85,9 +85,9 @@ class BxDolKey extends BxDolFactory implements iBxDolSingleton
      * @param $sKey - key string
      * @return true if key exists or false if key is missing
      */
-    public function isKeyExists ($sKey)
+    public function isKeyExists ($sKey, $sSalt = '')
     {
-        return $this->_oQuery->get($sKey) ? true : false;
+        return $this->_oQuery->get($sKey, $sSalt) ? true : false;
     }
 
     /**
@@ -95,9 +95,9 @@ class BxDolKey extends BxDolFactory implements iBxDolSingleton
      * @param $sKey - key string
      * @return true if key exists or false if key is missing
      */
-    public function getKeyData ($sKey)
+    public function getKeyData ($sKey, $sSalt = '')
     {
-        $sData = $this->_oQuery->getData($sKey);
+        $sData = $this->_oQuery->getData($sKey, $sSalt);
         if ($sData)
             return unserialize($sData);
         return '';

inc/classes/BxDolKeyQuery.php

@@ -18,9 +18,9 @@ class BxDolKeyQuery extends BxDolDb
         parent::__construct();
     }
 
-    public function insert ($sKey, $sData, $iExpire)
+    public function insert ($sKey, $sData, $iExpire, $sSalt = '')
     {
-        $sQuery = $this->prepare("INSERT INTO `sys_keys` SET `key` = ?, `data` = ?, `expire` = ?", $sKey, $sData, time() + $iExpire);
+        $sQuery = $this->prepare("INSERT INTO `sys_keys` SET `key` = ?, `data` = ?, `expire` = ?, `salt` = ?", $sKey, $sData, time() + $iExpire, $sSalt);
         return $this->query($sQuery);
     }
 
@@ -30,16 +30,26 @@ class BxDolKeyQuery extends BxDolDb
         return $this->query($sQuery);
     }
 
-    public function get ($sKey)
+    public function get ($sKey, $sSalt = '')
     {
-        $sQuery = $this->prepare("SELECT `key` FROM `sys_keys` WHERE `key` = ?", $sKey);
-        return $this->getOne($sQuery);
+        $sWhere = '';
+        $aBind = ['key' => $sKey];
+        if ($sSalt) {
+            $sWhere .= " AND `salt` = :salt ";
+            $aBind['salt'] = $sSalt;
+        }
+        return $this->getOne("SELECT `key` FROM `sys_keys` WHERE `key` = :key" . $sWhere, $aBind);
     }
 
-    public function getData ($sKey)
+    public function getData ($sKey, $sSalt = '')
     {
-        $sQuery = $this->prepare("SELECT `data` FROM `sys_keys` WHERE `key` = ?", $sKey);
-        return $this->getOne($sQuery);
+        $sWhere = '';
+        $aBind = ['key' => $sKey];
+        if ($sSalt) {
+            $sWhere .= " AND `salt` = :salt ";
+            $aBind['salt'] = $sSalt;
+        }
+        return $this->getOne("SELECT `data` FROM `sys_keys` WHERE `key` = :key" . $sWhere, $aBind);
     }
 
     public function prune ()

install/sql/system.sql

@@ -17,6 +17,7 @@ CREATE TABLE `sys_keys` (
   `key` varchar(32) NOT NULL,
   `data` text NOT NULL,
   `expire` int(11) NOT NULL,
+  `salt` varchar(255) NOT NULL,
   PRIMARY KEY (`key`)
 );
 

modules/base/general/classes/BxBaseModGeneralModule.php

@@ -412,11 +412,11 @@ class BxBaseModGeneralModule extends BxDolModule
             }
         }
         
-        if(!empty($CNF['FIELD_ADDED'])){
+        if(!empty($CNF['FIELD_ADDED']) && isset($aInputsAll[$CNF['FIELD_ADDED']])){
            $aSortableFields[] = $CNF['FIELD_ADDED'];
         }
         
-        if(!empty($CNF['FIELD_CHANGED'])){
+        if(!empty($CNF['FIELD_CHANGED']) && isset($aInputsAll[$CNF['FIELD_CHANGED']])){
            $aSortableFields[] = $CNF['FIELD_CHANGED'];
         }