request/input event listener
Checks if form token is valid if user is logged in.

@param eZURI $uri
342632
static public function input( eZURI $uri )
    {
        if ( isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] !== 'POST' && empty( $_POST ) )
        {
            eZDebugSetting::writeDebug( 'ezformtoken', 'Input not protected (not POST)', __METHOD__ );
            return null;
        }

        if ( !self::shouldProtectUser() )
        {
            eZDebugSetting::writeDebug( 'ezformtoken', 'Input not protected (not logged in user)', __METHOD__ );
            return null;
        }

        /* Not a safe assumtion, just kept for reference
        if ( !empty( $_SERVER['HTTP_X_REQUESTED_WITH'] )
          && trim( strtolower( $_SERVER['HTTP_X_REQUESTED_WITH'] ) ) === 'xmlhttprequest' )
        {
            eZDebugSetting::writeDebug( 'ezformtoken', 'Input not protected (ajax request)', __METHOD__ );
            return null;
        }*/

        if ( !empty( $_POST[self::getFormField()] ) )
        {
            $token = $_POST[self::getFormField()];
        }
        // allow ajax calls using POST with other formats than forms (such as
        // json or xml) to still validate using a custom http header
        else if ( !empty( $_SERVER['HTTP_X_CSRF_TOKEN'] ) )
        {
            $token = $_SERVER['HTTP_X_CSRF_TOKEN'];
        }
        else
        {
            throw new Exception( 'Missing form token from Request', 404 );
        }

        if ( $token !== self::getToken() )
            throw new Exception( 'Wrong form token found in Request!', 404 );

        eZDebugSetting::writeDebug( 'ezformtoken', 'Input validated, token verified and was correct', __METHOD__ );
    }
1368393
public function execute($uri)
    {
        foreach ($this->routes as $pattern => $callback) {
            if (preg_match($pattern, $uri, $params) === 1) {
                call_user_func_array($this->beforeRouteCallback, $params);
                array_shift($params);

                return call_user_func_array($callback, array_values($params));
            } else {
                error_log("$pattern did not match $uri");
            }
        }
    }
1118156
private function validate(ServerRequestInterface $request, string $tokenValue): bool
    {
        // Validate POST, PUT, DELETE, PATCH requests
        $method = $request->getMethod();
        if (!in_array($method, ['POST', 'PUT', 'DELETE', 'PATCH'])) {
            return true;
        }

        $postData = $request->getParsedBody();

        $requestCsrfToken = null;
        if (isset($postData[$this->name])) {
            $requestCsrfToken = $postData[$this->name];
        }
        if (!$requestCsrfToken) {
            // Reads the value and adds it to the request as the X-XSRF-TOKEN header.
            $headers = $request->getHeader('X-CSRF-Token');
            $requestCsrfToken = reset($headers);
        }

        if ($requestCsrfToken !== $tokenValue) {
            throw new RuntimeException('CSRF middleware failed. Invalid CSRF token. This looks like a cross-site request forgery.');
        }

        return true;
    }
1357665
public function checkRule(TypoScriptFrontendController $frontendController, string $uri, array &$explanation, bool &$skipProcessing)
    {
        if ($frontendController->isBackendUserLoggedIn()) {
            $skipProcessing = true;
            $explanation[__CLASS__] = 'Active BE Login (TSFE:beUserLogin)';
        }
    }
723524
public function callbackAction($callbackUri) {
		try {
			$this->authenticationManager->authenticate();
		} catch (\TYPO3\Flow\Security\Exception\AuthenticationRequiredException $exception) {
			$authenticationException = $exception;
		}

		if ($this->authenticationManager->isAuthenticated()) {
			$storedRequest = $this->securityContext->getInterceptedRequest();
			if ($storedRequest !== NULL) {
				$this->securityContext->setInterceptedRequest(NULL);
				$this->redirectToRequest($storedRequest);
			} else {
				// TODO Do we have to check the URI?
				$this->redirectToUri($callbackUri);
			}
		} else {
			throw new \Flowpack\SingleSignOn\Client\Exception('Could not authenticate in callbackAction triggered by the SSO server.', 1366613161, (isset($authenticationException) ? $authenticationException : NULL));
		}
	}
1128725
public function preSend(Event $e)
    {
        $validator = new NotEmpty();

        if (!isset($this->options['tokenOrLogin'])
            || !$validator->isValid($this->options['tokenOrLogin'])
        ) {
            throw new Exception\InvalidArgumentException('You need to set OAuth token!');
        }

        /* @var Http\Request $request */
        $request = $e->getTarget();

        $headers = $request->getHeaders();
        $params = array(
            'Authorization' => 'token ' . $this->options['tokenOrLogin'],
        );
        $headers->addHeaders($params);
    }
284519
protected function processUri($uri)
    {
        return preg_replace_callback('#\{([a-zA-Z0-9_,]*)\}#i', function ($matches) {
            return isset($this->tokens[$matches[1]]) ? $this->tokens[$matches[1]] : '';
        }, $uri);
    }
199784
private function isValidForRfc(string $rfc): bool
    {
        if ($this->parsedUri->hasUser() && Http::RFC_7230 === $rfc) {
            throw new MalformedUri(
                    'The URI ' . $this->parsedUri->asString()
                    . ' is not a valid HTTP URI according to ' . Http::RFC_7230
                    . ': contains userinfo, but this is disallowed'
            );
        }

        return $this->isSyntacticallyValid();
    }
440925
public function check()
    {
        if($this->session->get('token') === $this->request->input('token') || $this->session->get('token') === $this->request->header('X-CSRF-TOKEN')) {
            return true;
        }

        return false;
    }
1059295
public function checkRequest($request)
    {
        $member = Member::currentUser();
        if (!$member) {
            return false;
        }

        $salt = $request->getVar('s');
        $memberSalt = $this->memberSalt($salt, $member);
        $token = $this->getToken($memberSalt);

        // Ensure tokens match
        return $token === $request->getVar('t');
    }
732391
public function onUserActivationPost(UserActivationEvent $e) 
    {
        $password = $e->getParam('password');
        $email = $e->getParam('to');
        $siteUrl = $e->getParam('siteurl');
        $loginUri = $this->getModuleOptions()->getLoginUri();

        // something got really wrong if we get here...
        if(null === $email || null === $password) { 
        	return;
        }
        
        $transport = $this->getServiceLocator()->get('mailer.mail.transport.smtp');
        $message = $this->getServiceLocator()->get('mailer.mail.message.useractivation');
        $message->configure(array(
            'to' => $email,
            'siteurl' => $siteUrl,
            'loginurl' => $siteUrl . $loginUri, 
            'password' => $password,
        	'cdnurl' => $this->getModuleOptions()->getCdnUrl(),
            'siteName' => $this->getModuleOptions()->getSiteName()
        ));
        $transport->send($message);
    }
763838
public function onAuthenticationSuccess(Request $request, TokenInterface $token)
    {
        // get url to redirect (or return in the JSON-response)
        if ($this->session->get('_security.admin.target_path')
            && false !== strpos($this->session->get('_security.admin.target_path'), '#')
        ) {
            $url = $this->session->get('_security.admin.target_path');
        } else {
            $url = $this->router->generate('sulu_admin');
        }

        if ($request->isXmlHttpRequest()) {
            // if AJAX login
            $array = ['url' => $url];
            $response = new JsonResponse($array, 200);
        } else {
            // if form login
            $response = new RedirectResponse($url);
        }

        return $response;
    }
828443
public function onAfterLogin(UserEvent $event)
    {
        if (!$this->identity->is_api_user) {
            Yii::$app->language = $this->getInterfaceLanguage();
        }
    }
1352147
public function checkUri($uris)
    {
        if (!$this->request) {
            return false;
        }

        foreach ((array)$uris as $uri) {
            if ($this->uri == $uri) {
                return true;
            }
        }

        return false;
    }
819617
public function getRequestToken($callback_uri = NULL) {

    // set callback_uri
    $this->getOauthPlugin()->setCallbackUri($callback_uri);

    //Get request token
    $response = $this->get($this->getConfig('request_token_path'))->send();
    $request_token = array();
    parse_str($response->getBody(), $request_token);

    // Throw exception if the callback isn't confirmed
    if (!isset($request_token['oauth_callback_confirmed']) || !in_array($request_token['oauth_callback_confirmed'], array(true, "true"))) {
      throw new \Exception("There was an error regarding the callback confirmation");
    }

    // Return RequestToken
    return $request_token;
  }
408440
public function onAuthenticationSuccess(Request $request, TokenInterface $token)
    {
        if ($request->isXmlHttpRequest()) {
            /** @var User $user */
            $user = $token->getUser();
            $roles = $token->getRoles();
            $outputRoles = array();

            foreach ($roles as $role) {
                $outputRoles[] = $this->translator->trans('roles.' . $role->getRole(), array(), 'CodeLoversAngularBundle');
            }

            $output = $this->generator->getUserData($request, $token);

            // notify listeners to allow output modification
            $event = new LoginEvent($user);
            $event->setOutput($output);

            $this->dispatcher->dispatch(AuthEvents::LOGIN_SUCCESS, $event);

            return new JsonResponse($event->getOutput());
        } else {
            if ($targetPath = $request->getSession()->get('_security.target_path')) {
                $url = $targetPath;
            } else {
                $url = $this->getDefaultUrl();
            }

            return new RedirectResponse($url);
        }
    }
683915
public function onFilterResponse(FilterResponseEvent $e)
    {
        if ($e->getRequestType() !== HttpKernelInterface::MASTER_REQUEST) {
            return;
        }

        if ($this->needsCookieCleanup) {
            $e->getResponse()->headers->clearCookie('is_logged_in');
            $this->needsCookieCleanup = false;
        }
    }