Class \Prado\Security\TSecurityManager

TSecurityManager class

TSecurityManager provides private keys, hashing and encryption functionalities that may be used by other PRADO components, such as viewstate persister, cookies.

TSecurityManager is mainly used to protect data from being tampered and viewed. It can generate HMAC and encrypt the data. The private key used to generate HMAC is set by \Prado\Security\setValidationKey. The key used to encrypt data is specified by \Prado\Security\setEncryptionKey. If the above keys are not explicitly set, random keys will be generated and used.

To prefix data with an HMAC, call hashData(). To validate if data is tampered, call validateData(), which will return the real data if it is not tampered. The algorithm used to generated HMAC is specified by \Prado\Security\setHashAlgorithm.

To encrypt and decrypt data, call encrypt() and decrypt() respectively. The encryption algorithm can be set by \Prado\Security\setCryptAlgorithm.

Note, to use encryption, the PHP OpenSSL extension must be loaded. This was introduced in Prado4, older versions used the deprecated mcrypt extension with rijndael-256 cipher as default, which does not have an equivalent in OpenSSL. Developers should keep that in mind when migrating from Prado3 to Prado4.

Class hierarchy

\Prado\Security\TSecurityManager

\Prado\TModule implements IModule

\Prado\TApplicationComponent

\Prado\TComponent

Author: Qiang Xue <qiang.xue@gmail.com>
Author: LANDWEHR Computer und Software GmbH <programmierung@landwehr-software.de>
Since: 3.0

Methods summary
`public`	`decrypt(string $data) : string` Decrypts data with {@see getEncryptionKey EncryptionKey}.
`public`	`encrypt(string $data) : string` Encrypts data with {@see getEncryptionKey EncryptionKey}.
`public`	`getCryptAlgorithm() : mixed`
`public`	`getEncryptionKey() : string`
`public`	`getHashAlgorithm() : string`
`public`	`getValidationKey() : string`
`public`	`hashData(string $data) : string` Prefixes data with an HMAC.
`public`	`init(TXmlElement $config) : mixed` Initializes the module. The security module is registered with the application.
`public`	`setCryptAlgorithm(mixed $value) : mixed` Sets the crypt algorithm (also known as cipher or cypher) that will be used for {@see encrypt} and {@see decrypt}.
`public`	`setEncryptionKey(string $value) : mixed`
`public`	`setHashAlgorithm(string $value) : mixed` This method accepts all hash algorithms returned by hash_algos().
`public`	`setValidationKey(string $value) : mixed`
`public`	`validateData(string $data) : string` Validates if data is tampered.
`protected`	`computeHMAC(string $data) : string` Computes the HMAC for the data with {@see getValidationKey ValidationKey}.
`protected`	`generateRandomKey() : mixed` Generates a random key.
`private`	`strlen(string $string) : int` Returns the length of the given string. If available uses the multibyte string function mb_strlen.
`private`	`substr(string $string, int $start, int $length) : string` Returns the portion of string specified by the start and length parameters. If available uses the multibyte string function mb_substr

Inherited methods
__call, __callStatic, __clone, __construct, __destruct, __get, __isset, __set, __sleep, __unset, __wakeup, addParsedObject, asa, attachBehavior, attachBehaviors, attachClassBehavior, attachEventHandler, callBehaviorsMethod, canGetProperty, canSetProperty, clearBehaviors, createdOnTemplate, detachBehavior, detachBehaviors, detachClassBehavior, detachEventHandler, disableBehavior, disableBehaviors, enableBehavior, enableBehaviors, evaluateExpression, evaluateStatements, fxAttachClassBehavior, fxDetachClassBehavior, getApplication, getAutoGlobalListen, getBehaviors, getBehaviorsEnabled, getClassHierarchy, getEventHandlers, getID, getListeningToGlobalEvents, getRequest, getResponse, getService, getSession, getSubProperty, getUser, hasEvent, hasEventHandler, hasMethod, hasProperty, init, isa, listen, publishAsset, publishFilePath, raiseEvent, setID, setSubProperty, unlisten, _getZappableSleepProps, getCallChain, getClassFxEvents, instanceBehavior, filter_prado_fx

Constants summary
`public mixed`	`STATE_ENCRYPTION_KEY`	`'prado:securitymanager:encryptionkey'`
`public mixed`	`STATE_VALIDATION_KEY`	`'prado:securitymanager:validationkey'`

Inherited constants
`\Prado\TApplicationComponent::FX_CACHE_FILE, \Prado\TComponent::GLOBAL_RAISE_EVENT_LISTENER`

Classes

Interfaces

Traits

Search results

Class \Prado\Security\TSecurityManager

Class hierarchy