【发布时间】:2016-03-24 00:40:27
【问题描述】:
我正在用 PHP 编写一个大脚本,该脚本需要在未来用户创建的扩展中保持安全。 我想创建类似权限类检查对某些核心变量的扩展访问等的东西。
这里是启动类:
class SystemStartup
{
private function startClass ( ) {
require ( dirname( __FILE__ ) . '/sys.run.php' );
//starting SystemRun with something like core security token
new SystemRun ( hash ( 'sha256' , $_SERVER['HTTP_USER_AGENT'] . $_SERVER['REMOTE_ADDR'] . microtime ( TRUE ) ) );
}
function __construct ( ) {
//here i have some security stuff like checking class not already running
$this -> startClass ( );
}
function __destruct ( ) {
//wywolane na samym koncu
}
};
SystemRun 类:
class SystemRun
{
private $SystemToken;
//static because i want to be callable from other classes extending SystemRun
protected static $SystemUrlControl;
private function startClass ( ) {
//before more code
//loading file with child class
require ( dirname( __FILE__ ) . '/urlcontrol.php' );
//starting it with security token
echo $this -> SystemToken; //just for check
self :: $SystemUrlControl = new SystemUrlControl ( $this -> SystemToken );
//more more more code (its main class)
}
protected function validateToken ( $SystemToken ) {
echo $this -> SystemToken; //just for check
//this should check tokens are the same
if ( $this -> SystemToken == $SystemToken ) return TRUE;
return FALSE;
}
function __construct ( $SystemToken ) {
//saving token for next classes
$this -> SystemToken = $SystemToken;
$this -> startClass ( );
}
};
现在 SystemUrlControl 扩展了 SystemRun
class SystemUrlControl extends SystemRun
{
private $SystemToken;
//functions
//more functions
//more more more
function __construct ( $SystemToken ) {
if ( !parent :: validateToken ( $SystemToken ) ) echo 'somebody else called me!';
$this -> SystemToken = $SystemToken;
}
};
问题是从 SystemUrlControl 调用 validateToken 返回 FALSE - SystemRun 将它自己的 SystemToken 视为 NULL。
输出(来自回声)是:
> 5b6a09d8f03dd7e6229a5... (valid token) (here NULL value) somebody else called me!
【问题讨论】:
-
self :: $SystemToken不是静态成员,因此必须与$this->SystemToken一起使用。 -
它少一个“ctrl+z”然后在调试时改变;)