add nonce generator/validator (plugin framework enhancement)

git-svn-id: http://dev.piwik.org/svn/trunk@1909 59fd770c-687e-43c8-a1e3-f5a4ff64c105

4 files changed, 101 insertions, 3 deletions

diff --git a/core/Common.php b/core/Common.php
index f1eaa3fe08..a5199897f6 100644
--- a/core/Common.php
+++ b/core/Common.php
@@ -568,6 +568,62 @@ class Piwik_Common
 	}
 
 	/**
+	 * Generate nonce
+	 *
+	 * @param string $id Unique id to avoid namespace conflicts, e.g., ModuleName.ActionName
+	 * @param int $ttl Optional time-to-live in seconds; default is 5 minutes
+	 * @return string Nonce
+	 */
+	static public function getNonce($id, $ttl = 300)
+	{
+		// the ingredients to our secret sauce? a dash of private salt and a flavorful mix of PRNGs, making it less predictable in nature, yet retaining a subtle hint of more entropy
+		$nonce = md5(self::getSalt() . self::generateUniqId());
+
+		// keeping it simple: store the host and path to the Piwik root
+		$referer = @parse_url(Piwik_Url::getReferer());
+		$url = $referer ? $referer['host'] .'/'. (isset($referer['path']) ? $referer['path'] .'/' : '') : '';
+
+		// save session-dependent nonce
+		$ns = new Zend_Session_Namespace($id);
+		$ns->snonce = array(
+			'nonce' => $nonce,
+			'url' => $url,
+		);
+		$ns->setExpirationSeconds($ttl, 'snonce');
+
+		return $nonce;
+	}
+
+	/**
+	 * Verify nonce
+	 *
+	 * @param string $id Unique id
+	 * @param string $nonce Nonce sent to client
+	 * @return bool true if valid; false otherwise
+	 */
+	static public function verifyNonce($id, $nonce)
+	{
+		$ns = new Zend_Session_Namespace($id);
+		$snonce = $ns->snonce;
+
+		// validate token
+		if(empty($nonce) || $snonce['nonce'] !== $nonce)
+		{
+			return false;
+		}
+
+		// validate referer
+		$referer = @parse_url(Piwik_Url::getReferer());
+		$url = $referer ? $referer['host'] .'/'. (isset($referer['path']) ? $referer['path'] .'/' : '') : '';
+		if((empty($snonce['url']) xor empty($url)) || ($nonce['url'] !== $url))
+		{
+			return false;
+		}
+
+		return true;		
+	}
+
+	/**
 	 * Convert dotted IP to a stringified integer representation
 	 *
 	 * @return string ip
diff --git a/core/Plugin.php b/core/Plugin.php
index d0d118180a..362f4e4713 100644
--- a/core/Plugin.php
+++ b/core/Plugin.php
@@ -99,4 +99,14 @@ abstract class Piwik_Plugin
 	{
 		return substr(get_class($this), strlen("Piwik_"));
 	}
+
+	/**
+	 * Get cron schedule
+	 *
+	 * @return string|false A crontab like schedule
+	 */
+	public function getSchedule()
+	{
+		return false;
+	}
 }
diff --git a/core/SmartyPlugins/modifier.stripeol.php b/core/SmartyPlugins/modifier.stripeol.php
new file mode 100644
index 0000000000..d9e70f810d
--- /dev/null
+++ b/core/SmartyPlugins/modifier.stripeol.php
@@ -0,0 +1,32 @@
+<?php
+/**
+ * Piwik - Open source web analytics
+ * 
+ * @link http://piwik.org
+ * @license http://www.gnu.org/licenses/gpl-3.0.html Gpl v3 or later
+ * @version $Id$
+ * 
+ * @category Piwik
+ * @package SmartyPlugins
+ */
+
+/**
+ * Smarty stripeol modifier plugin
+ *
+ * Type:     modifier<br>
+ * Name:     stripeol<br>
+ * Purpose:  Replace all end-of-line characters with platform specific string.<br>
+ * Example:  {$var|stripeol}
+ * Date:     March 10th, 2010
+ * @author   anthon (at) piwik.org
+ * @version  1.0
+ * @param string
+ * @param string
+ * @return string
+ */
+function smarty_modifier_stripeol($text)
+{
+    return preg_replace('!(\r\n|\r|\n)!', PHP_EOL, $text);
+}
+
+/* vim: set expandtab: */
diff --git a/core/Tracker/Visit.php b/core/Tracker/Visit.php
index 7b73acc0a4..1625e7c84c 100644
--- a/core/Tracker/Visit.php
+++ b/core/Tracker/Visit.php
@@ -388,7 +388,7 @@ class Piwik_Tracker_Visit implements Piwik_Tracker_Visit_Interface
 	 *
 	 * @return long
 	 */
-	protected function getVisitorIp()
+	public function getVisitorIp()
 	{
 		return Piwik_Common::getIp();
 	}
@@ -398,7 +398,7 @@ class Piwik_Tracker_Visit implements Piwik_Tracker_Visit_Interface
 	 *
 	 * @return string
 	 */
-	protected function getUserAgent()
+	public function getUserAgent()
 	{
 		return @$_SERVER['HTTP_USER_AGENT'];
 	}
@@ -446,7 +446,7 @@ class Piwik_Tracker_Visit implements Piwik_Tracker_Visit_Interface
 				  || preg_match('/Googlebot/', $ua);			// Googlebot
 
 		/* custom filters can override the built-in filter above */
-		Piwik_PostEvent('Tracker.Visit.isExcluded', $excluded);
+		Piwik_PostEvent('Tracker.Visit.isExcluded', $excluded, $this);
 
 		if($excluded)
 		{