concrete/src/Validation/CSRF/Token.php
public function validate($action = '', $token = null)
    {
        $app = Application::getFacadeApplication();
        if ($token == null) {
            $request = $app->make(Request::class);
            $token = $request->request->get(static::DEFAULT_TOKEN_NAME);
            if ($token === null) {
                $token = $request->query->get(static::DEFAULT_TOKEN_NAME);
            }
        }
        if (is_string($token)) {
            $parts = explode(':', $token);
            if ($parts[0] && isset($parts[1])) {
                $time = $parts[0];
                $hash = $parts[1];
                $compHash = $this->generate($action, $time);
                $now = time();

                if (substr($compHash, strpos($compHash, ':') + 1) == $hash) {
                    $diff = $now - $time;
                    //hash is only valid if $diff is less than VALID_HASH_TIME_RECORD
                    return $diff <= static::VALID_HASH_TIME_THRESHOLD;
                } else {
                    $logger = $app->make('log/factory')->createLogger(Channels::CHANNEL_SECURITY);
                    $u = new User();
                    $logger->debug(t('Validation token did not match'), [
                        'uID' => $u->getUserID(),
                        'action' => $action,
                        'time' => $time,
                    ]);
                }
            }
        }

        return false;
    }
public function validate($action = '', $token = null)
    {
        $app = Application::getFacadeApplication();
        if ($token == null) {
            $request = $app->make(Request::class);
            $token = $request->request->get(static::DEFAULT_TOKEN_NAME);
            if ($token === null) {
                $token = $request->query->get(static::DEFAULT_TOKEN_NAME);
            }
        }
        if (is_string($token)) {
            $parts = explode(':', $token);
            if ($parts[0] && isset($parts[1])) {
                $time = $parts[0];
                $hash = $parts[1];
                $compHash = $this->generate($action, $time);
                $now = time();

                if (substr($compHash, strpos($compHash, ':') + 1) == $hash) {
                    $diff = $now - $time;
                    //hash is only valid if $diff is less than VALID_HASH_TIME_RECORD
                    return $diff <= static::VALID_HASH_TIME_THRESHOLD;
                } else {
                    $logger = $app->make('log/factory')->createLogger(Channels::CHANNEL_SECURITY);
                    $u = new User();
                    $logger->debug(t('Validation token did not match'), [
                        'uID' => $u->getUserID(),
                        'action' => $action,
                        'time' => $time,
                    ]);
                }
            }
        }

        return false;
    }
public function validate ( $ action = '' , $ token = null ) { $ app = Application :: getFacadeApplication ( ) ; if ( $ token == null ) { $ request = $ app -> make ( Request :: class ) ; $ token = $ request -> request -> get ( static :: DEFAULT_TOKEN_NAME ) ; if ( $ token === null ) { $ token = $ request -> query -> get ( static :: DEFAULT_TOKEN_NAME ) ; } } if ( is_string ( $ token ) ) { $ parts = explode ( ':' , $ token ) ; if ( $ parts [ 0 ] && isset ( $ parts [ 1 ] ) ) { $ time = $ parts [ 0 ] ; $ hash = $ parts [ 1 ] ; $ compHash = $ this -> generate ( $ action , $ time ) ; $ now = time ( ) ; if ( substr ( $ compHash , strpos ( $ compHash , ':' ) + 1 ) == $ hash ) { $ diff = $ now - $ time ; //hash is only valid if $diff is less than VALID_HASH_TIME_RECORD return $ diff <= static :: VALID_HASH_TIME_THRESHOLD ; } else { $ logger = $ app -> make ( 'log/factory' ) -> createLogger ( Channels :: CHANNEL_SECURITY ) ; $ u = new User ( ) ; $ logger -> debug ( t ( 'Validation token did not match' ) , [ 'uID' => $ u -> getUserID ( ) , 'action' => $ action , 'time' => $ time , ] ) ; } } } return false ; }
Validate a token against a given action.

Basically, we check the passed hash to see if:
a. the hash is valid. That means it computes in the time:action:pepper format
b. the time included next to the hash is within the threshold.

@param string $action The action that should be associated to the token
@param string $token The token to be validated (if empty we'll retrieve it from the current request)

@return bool
Validate a token against a given action .