<commit_before><?php

namespace ModHelper;

/**
 * Nonce, an anti CSRF token generation/checking class.
 * Copyright (c) 2011 <NAME> <http://bkcore.com/blog/code/nocsrf-php-class.html>
 * @copyright Copyright (c) 2015 <NAME>
 * @license http://opensource.org/licenses/MIT MIT
 *
 * @package ModHelper
 * @version 1.0
 */
class Nonce
{
	/**
	 * @var string
	 */
	private $hash;

	protected $doOriginCheck = false;
	/**
	 * @var string
	 */
	private $key;

	/**
	 * @var int
	 */
	private $ttl = 900;

	/**
	 * Check CSRF tokens match between session and $origin.
	 * Make sure you generated a token in the form before checking it.
	 *
	 * @param String $key The session and $origin key where to find the token.
	 * @param Mixed $origin The object/associative array to retreive the token data from (usually $_POST).
	 * @param Boolean $throwException (Facultative) TRUE to throw exception on check fail, FALSE or default to return false.
	 * @param Integer $timespan (Facultative) Makes the token expire after $timespan seconds. (null = never)
	 * @param Boolean $multiple (Facultative) Makes the token reusable and not one-time. (Useful for ajax-heavy requests).
	 *
	 * @return Boolean Returns FALSE if a CSRF attack is detected, TRUE otherwise.
	 */
	public function check($key, $origin, $throwException = false, $timespan = null, $multiple = false)
	{
		if (!isset($_SESSION['csrf_' . $key])) {
			if ($throwException) {
				throw new Exception('Missing CSRF session token.');
			} else {
				return false;
			}
		}

		if (!isset($origin[$key])) {
			if ($throwException) {
				throw new Exception('Missing CSRF form token.');
			} else {
				return false;
			}
		}

		// Get valid token from session
		$hash = $_SESSION['csrf_' . $key];

		// Free up session token for one-time CSRF token usage.
		if (!$multiple) {
			$_SESSION['csrf_' . $key] = null;
		}

		// Origin checks
		if (self::$doOriginCheck && sha1($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']) != substr(base64_decode($hash), 10, 40)) {
			if ($throwException) {
				throw new Exception('Form origin does not match token origin.');
			} else {
				return false;
			}
		}

		// Check if session token matches form token
		if ($origin[$key] != $hash) {
			if ($throwException) {
				throw new Exception('Invalid CSRF token.');
			} else {
				return false;
			}
		}

		// Check for token expiration
		if ($timespan != null && is_int($timespan) && intval(substr(base64_decode($hash), 0, 10)) + $timespan < time()) {
			if ($throwException) {
				throw new Exception('CSRF token has expired.');
			} else {
				return false;
			}
		}
<commit_msg>Exceptions must always be thrown<commit_after><?php

namespace ModHelper;

/**
 * Nonce, an anti CSRF token generation/checking class.
 * Copyright (c) 2011 <NAME> <http://bkcore.com/blog/code/nocsrf-php-class.html>
 * @copyright Copyright (c) 2015 <NAME>
 * @license http://opensource.org/licenses/MIT MIT
 *
 * @package ModHelper
 * @version 1.0
 */
class Nonce
{
	/**
	 * @var string
	 */
	private $hash;

	protected $doOriginCheck = false;
	/**
	 * @var string
	 */
	private $key;

	/**
	 * @var int
	 */
	private $ttl = 900;

	/**
	 * Check CSRF tokens match between session and $origin.
	 * Make sure you generated a token in the form before checking it.
	 *
	 * @param String $key The session and $origin key where to find the token.
	 * @param Mixed $origin The object/associative array to retreive the token data from (usually $_POST).
	 * @param Boolean $throwException (Facultative) TRUE to throw exception on check fail, FALSE or default to return false.
	 * @param Integer $timespan (Facultative) Makes the token expire after $timespan seconds. (null = never)
	 * @param Boolean $multiple (Facultative) Makes the token reusable and not one-time. (Useful for ajax-heavy requests).
	 *
	 * @return Boolean Returns FALSE if a CSRF attack is detected, TRUE otherwise.
	 */
	public function check($key, $origin, $throwException = false, $timespan = null, $multiple = false)
	{
		if (!isset($_SESSION['csrf_' . $this->key])) {
			throw new Exception('Missing CSRF session token.');
		}

		if (!isset($_POST[$this->key])) {
			throw new Exception('Missing CSRF form token.');
		}

		// Get valid token from session
		$hash = $_SESSION['csrf_' . $key];

		// Free up session token for one-time CSRF token usage.
		if (!$multiple) {
			$_SESSION['csrf_' . $key] = null;
		}

		// Origin checks
		if ($this->originCheck && sha1($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']) != substr(base64_decode($this->hash), 10, 40)) {
			throw new Exception('Form origin does not match token origin.');
		}

		// Check if session token matches form token
		if ($_POST[$this->key] != $this->hash) {
			throw new Exception('Invalid CSRF token.');
		}

		// Check for token expiration
		if ($this->ttl != null && is_int($this->ttl) && intval(substr(base64_decode($this->hash), 0, 10)) + $this->ttl < time()) {
			throw new Exception('CSRF token has expired.');
		}

{'fraction_non_alphanumeric': 0.1393574297188755, 'fraction_numerical': 0.010040160642570281, 'mean_word_length': 3.4393939393939394, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 19, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '292736', 'n_tokens_mistral': 1751, 'n_tokens_neox': 1535, 'n_words': 529}