1. class
  2. Tfish
  3. \
  4. Controller
  5. \
  6. Yubikey

Yubikey

class Yubikey

Controller for two-factor login with a Yubikey hardware token.

Traits

ValidateString
Provides methods for validating UTF-8 character encoding and string composition.
ValidateToken
Provides method for validating cross-site request forgery tokens.

Methods

string
encodeEscapeUrl(string $url)

URL-encode and escape a query string for use in a URL.

from ValidateString
bool
isAlnum(string $alnum)

Check that a string is comprised solely of alphanumeric characters.

from ValidateString
bool
isAlnumUnderscore(string $alnumUnderscore)

Check that a string is comprised solely of alphanumeric characters and underscores.

from ValidateString
bool
isAlpha(string $alpha)

Check that a string is comprised solely of alphabetical characters.

from ValidateString
bool
isUtf8(string $text)

Check if the character encoding of text is UTF-8.

from ValidateString
string
trimString(mixed $text)

Cast to string, check UTF-8 encoding and strip trailing whitespace and control characters.

from ValidateString
boolean
validateToken(string $token)

Validate a cross-site request forgery token from a form submission.

from ValidateToken
__construct(object $model, object $viewModel, Session $session)

Constructor

array
display()

Display the Yubikey login form.

array
login()

Process login submission.

Details

in ValidateString at line 41
string encodeEscapeUrl(string $url)

URL-encode and escape a query string for use in a URL.

Trims, checks for UTF-8 compliance, rawurlencodes and then escapes with htmlspecialchars(). If you wish to use the data on a landing page you must decode it with htmlspecialchars_decode() followed by rawurldecode() in that order. But really, if you are using any characters that need to be encoded in the first place you should probably just stop.

Parameters

string $url Unescaped input URL.

Return Value

string Encoded and escaped URL.

in ValidateString at line 59
bool isAlnum(string $alnum)

Check that a string is comprised solely of alphanumeric characters.

Accented regional characters are rejected. This method is designed to be used to check database identifiers or object property names.

Parameters

string $alnum Input to be tested.

Return Value

bool True if valid alphanumerical string, false otherwise.

in ValidateString at line 77
bool isAlnumUnderscore(string $alnumUnderscore)

Check that a string is comprised solely of alphanumeric characters and underscores.

Accented regional characters are rejected. This method is designed to be used to check database identifiers or object property names.

Parameters

string $alnumUnderscore Input to be tested.

Return Value

bool True if valid alphanumerical or underscore string, false otherwise.

in ValidateString at line 95
bool isAlpha(string $alpha)

Check that a string is comprised solely of alphabetical characters.

Tolerates vanilla ASCII only. Accented regional characters are rejected. This method is designed to be used to check database identifiers or object property names.

Parameters

string $alpha Input to be tested.

Return Value

bool True if valid alphabetical string, false otherwise.

in ValidateString at line 113
bool isUtf8(string $text)

Check if the character encoding of text is UTF-8.

All strings received from external sources must be passed through this function, particularly prior to storage in the database.

Parameters

string $text Input string to check.

Return Value

bool True if string is UTF-8 encoded otherwise false.

in ValidateString at line 131
string trimString(mixed $text)

Cast to string, check UTF-8 encoding and strip trailing whitespace and control characters.

Removes trailing whitespace and control characters (ASCII <= 32 / UTF-8 points 0-32 inclusive), checks for UTF-8 character set and casts input to a string. Note that the data returned by this function still requires escaping at the point of use; it is not database or XSS safe.

As the input is cast to a string do NOT apply this function to non-string types (int, float, bool, object, resource, null, array, etc).

Parameters

mixed $text Input to be trimmed.

Return Value

string Trimmed and UTF-8 validated string.

in ValidateToken at line 40
boolean validateToken(string $token)

Validate a cross-site request forgery token from a form submission.

Forms contain a hidden field with a random token taken from the user's session. This token is used to validate that a form submission did indeed originate from the user, by comparing the value against that stored in the user's session. If they do not match then the request could be a forgery and the form submission should be rejected.

Parameters

string $token A form token to validate against the user's session.

Return Value

boolean True if token is valid.

at line 49
__construct(object $model, object $viewModel, Session $session)

Constructor

Parameters

object $model Instance of a model class.
object $viewModel Instance of a viewModel class.
Session $session Instance of the session management class.

at line 63
array display()

Display the Yubikey login form.

Return Value

array Empty array (the output of this action is not cached).

at line 75
array login()

Process login submission.

Return Value

array Empty array (the output of this action is not cached).