src/Core/LTIX.php
private static function checkCSRF($session_object=null) {
        global $CFG;
        $token = self::wrapped_session_get($session_object,'CSRF_TOKEN');
        if ( ! $token ) return false;
        if ( isset($_POST['CSRF_TOKEN']) && $token == $_POST['CSRF_TOKEN'] ) return true;
        $headers = array_change_key_case(apache_request_headers());
        if ( isset($headers['x-csrf-token']) && $token == $headers['x-csrf-token'] ) return true;
        if ( isset($headers['x-csrftoken']) && $token == $headers['x-csrftoken'] ) return true;
        return false;
    }
private static function checkCSRF($session_object=null) {
        global $CFG;
        $token = self::wrapped_session_get($session_object,'CSRF_TOKEN');
        if ( ! $token ) return false;
        if ( isset($_POST['CSRF_TOKEN']) && $token == $_POST['CSRF_TOKEN'] ) return true;
        $headers = array_change_key_case(apache_request_headers());
        if ( isset($headers['x-csrf-token']) && $token == $headers['x-csrf-token'] ) return true;
        if ( isset($headers['x-csrftoken']) && $token == $headers['x-csrftoken'] ) return true;
        return false;
    }
private static function checkCSRF ( $ session_object = null ) { global $ CFG ; $ token = self :: wrapped_session_get ( $ session_object , 'CSRF_TOKEN' ) ; if ( ! $ token ) return false ; if ( isset ( $ _POST [ 'CSRF_TOKEN' ] ) && $ token == $ _POST [ 'CSRF_TOKEN' ] ) return true ; $ headers = array_change_key_case ( apache_request_headers ( ) ) ; if ( isset ( $ headers [ 'x-csrf-token' ] ) && $ token == $ headers [ 'x-csrf-token' ] ) return true ; if ( isset ( $ headers [ 'x-csrftoken' ] ) && $ token == $ headers [ 'x-csrftoken' ] ) return true ; return false ; }
Returns true for a good CSRF and false if we could not verify it
Returns true for a good CSRF and false if we could not verify it