<commit_before><?php
/**
* CSRF Protection Class
*/
class CSRF_Protection
{
  /**
   * Holds CI instance
   *
   * @var CI instance
   */
  private $CI;
  
  /**
   * Name used to store token on session
   *
   * @var string
   */
  private static $token_name = 'li_token';
  
  /**
   * Stores the token
   *
   * @var string
   */
  private static $token;
  
  // -----------------------------------------------------------------------------------
  
  public function __construct()
  {
    $this->CI =& get_instance();
  }
  
  // -----------------------------------------------------------------------------------
  
  /**
   * Generates a CSRF token and stores it on session. Only one token per session is generated.
   * This must be tied to a post-controller hook, and before the hook
   * that calls the inject_tokens method().
   *
   * @return void
   * @author <NAME>
   */
  public function generate_token()
  {
    if ( ! $this->CI->config->item('linkigniter.enable_csrf_protection'))
    {
      return;
    }
    
    // Load session library if not loaded
    $this->CI->load->library('session');
    
    if ($this->CI->session->userdata(self::$token_name) === FALSE)
    {
      // Generate a token and store it on session, since old one appears to have expired.
      self::$token = md5(uniqid() . microtime() . rand());

      $this->CI->session->set_userdata(self::$token_name, self::$token);
    }
    else
    {
      // Set it to local variable for easy access
      self::$token = $this->CI->session->userdata(self::$token_name);
    }
  }
  
  // -----------------------------------------------------------------------------------
  
  /**
   * This injects hidden tags on all POST forms with the csrf token.
   * Also injects meta headers in <head> of output (if exists) for easy access
   * from JS frameworks.
   *
   * @return void
   * @author <NAME>
   */
  public function inject_tokens()
  {
    if ( ! $this->CI->config->item('linkigniter.enable_csrf_protection'))
    {
      // This has to be here otherwise nothing is sent to the browser
      $this->CI->output->_display($this->CI->output->get_output());
      return;
    }
    
    $output = $this->CI->output->get_output();
    
    // Inject into form
    $output = preg_replace('/(<(form|FORM).*(method|METHOD)="(post|POST)".*>)/', 
                           '$0<input type="hidden" name="' . self::$token_name . '" value="' . self::$token . '">', 
                           $output);
    
    // Inject into <head>
    $output = preg_replace('/(<\/head>)/',
                           '<meta name="csrf-name" content="' . self::$token_name . '">' . "\n" . '<meta name="csrf-token" content="' . self::$token . '">' . "\n" . '$0', <commit_msg>Fixing bug on csrf lib<commit_after><?php
/**
* CSRF Protection Class
*/
class CSRF_Protection
{
  /**
   * Holds CI instance
   *
   * @var CI instance
   */
  private $CI;
  
  /**
   * Name used to store token on session
   *
   * @var string
   */
  private static $token_name = 'li_token';
  
  /**
   * Stores the token
   *
   * @var string
   */
  private static $token;
  
  // -----------------------------------------------------------------------------------
  
  public function __construct()
  {
    $this->CI =& get_instance();
  }
  
  // -----------------------------------------------------------------------------------
  
  /**
   * Generates a CSRF token and stores it on session. Only one token per session is generated.
   * This must be tied to a post-controller hook, and before the hook
   * that calls the inject_tokens method().
   *
   * @return void
   * @author <NAME>
   */
  public function generate_token()
  {
    if ( ! $this->CI->config->item('linkigniter.enable_csrf_protection'))
    {
      return;
    }
    
    // Load session library if not loaded
    $this->CI->load->library('session');
    
    if ($this->CI->session->userdata(self::$token_name) === FALSE)
    {
      // Generate a token and store it on session, since old one appears to have expired.
      self::$token = md5(uniqid() . microtime() . rand());

      $this->CI->session->set_userdata(self::$token_name, self::$token);
    }
    else
    {
      // Set it to local variable for easy access
      self::$token = $this->CI->session->userdata(self::$token_name);
    }
  }
  
  // -----------------------------------------------------------------------------------
  
  /**
   * This injects hidden tags on all POST forms with the csrf token.
   * Also injects meta headers in <head> of output (if exists) for easy access
   * from JS frameworks.
   *
   * @return void
   * @author <NAME>
   */
  public function inject_tokens()
  {
    if ( ! $this->CI->config->item('linkigniter.enable_csrf_protection'))
    {
      // This has to be here otherwise nothing is sent to the browser
      $this->CI->output->_display($this->CI->output->get_output());
      return;
    }
    
    $output = $this->CI->output->get_output();
    
    // Inject into form
    $output = preg_replace('/(<(form|FORM)[^>]*(method|METHOD)="(post|POST)"[^>]*>)/',
                           '$0<input type="hidden" name="' . self::$token_name . '" value="' . self::$token . '">', 
                           $output);
    
    // Inject into <head>
    $output = preg_replace('/(<\/head>)/',
                           '<meta name="csrf-name" content="' . self::$token_name . '">' . "\n" . '<meta name="csrf-token" content="' . self::$token . '">' . "\n" . '$0', 
{'fraction_non_alphanumeric': 0.23943148688046648, 'fraction_numerical': 0.0010932944606413995, 'mean_word_length': 1.6854207436399218, 'pattern_counts': {'":': 0, '<': 23, '<?xml version=': 0, '>': 79, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4768366', 'n_tokens_mistral': 1629, 'n_tokens_neox': 1622, 'n_words': 416}