CoolCMS API

AdvertManageKey
in package

FinalYes

Link "Manage advert" from the e-mail sent after adding an advert without an account (Bazaar advert, Comcat company profile). Replaces the readable management password the e-mail used to carry.

The key from the link grants the same as entering the password in the "Manage advert" form: an edit session ([id, password hash, expiry] in the session, from which the Api capability is derived). Properties:

  • the database holds only the digest sha256(key | advert password hash) and the expiry; the readable key exists only in the e-mail;
  • valid for self::TTL_SECONDS (7 days) and reusable during that time, so a link scanner in the mailbox does not burn it before the owner clicks;
  • bound to the password: once the advert password changes (reset, edit, admin) the digest no longer matches and the link stops working without anyone clearing the column;
  • after expiry only the password chosen by the author or "Forgotten password" works (PasswordResetToken).

Pure functions without I/O; storing and verifying is done by the Api manager (ManageKeyTrait).

Table of Contents

Constants

TTL_SECONDS  : int = 7 * 24 * 3600
Validity of the link from the insert e-mail.

Methods

buildExpiry()  : DateTime
generate()  : string
32 random bytes as hex (64 characters, 256 bits), usable in a URL as is.
hash()  : string
Digest of the key bound to the current password hash of the advert (64 hex characters).
matches()  : bool
Returns whether the key from the link matches the stored digest for the current advert password and is still valid.

Constants

TTL_SECONDS

Validity of the link from the insert e-mail.

public int TTL_SECONDS = 7 * 24 * 3600

Methods

buildExpiry()

public static buildExpiry(DateTimeInterface $now) : DateTime
Parameters
$now : DateTimeInterface
Return values
DateTime

generate()

32 random bytes as hex (64 characters, 256 bits), usable in a URL as is.

public static generate() : string
Return values
string

hash()

Digest of the key bound to the current password hash of the advert (64 hex characters).

public static hash(string $plainKey, string $passwordHash) : string
Parameters
$plainKey : string
$passwordHash : string
Return values
string

matches()

Returns whether the key from the link matches the stored digest for the current advert password and is still valid.

public static matches(string $plainKey, string|null $storedHash, DateTimeInterface|null $expiresAt, string|null $passwordHash, DateTimeInterface $now) : bool

An empty key or a missing digest, password or expiry yields false. The comparison runs in constant time (hash_equals).

Parameters
$plainKey : string
$storedHash : string|null
$expiresAt : DateTimeInterface|null
$passwordHash : string|null
$now : DateTimeInterface
Return values
bool
On this page

Search results