How is \Magento\Backend\Model\Url::useSecretKey() implemented and used?

dmitrii_fediuk · May 21, 2016, 10:59pm

Context: How is the «Add Secret Key to URLs» backend option implemented and used?

Implementation

magento/magento2/blob/b366da/app/code/Magento/Backend/Model/Url.php#L259-L267


/**
 * Return secret key settings flag
 *
 * @return bool
 */
public function useSecretKey()
{
    return $this->_scopeConfig->isSetFlag(self::XML_PATH_USE_SECURE_KEY) && !$this->getNoSecret();
}

Details: How are setNoSecret() / getNoSecret() methods of the \Magento\Backend\Model\Url class used?

Usages

1. \Magento\Backend\App\AbstractAction::_processUrlKeys()

github.com

magento/magento2/blob/b366da/app/code/Magento/Backend/App/AbstractAction.php#L252-L260


if ($this->_auth->isLoggedIn()) {
    if ($this->getRequest()->isPost()) {
        $_isValidFormKey = $this->_formKeyValidator->validate($this->getRequest());
        $_keyErrorMsg = __('Invalid Form Key. Please refresh the page.');
    } elseif ($this->_backendUrl->useSecretKey()) {
        $_isValidSecretKey = $this->_validateSecretKey();
        $_keyErrorMsg = __('You entered an invalid Secret Key. Please refresh the page.');
    }
}

2. \Magento\Backend\App\Action\Plugin\Authentication::_redirectIfNeededAfterLogin()

github.com

magento/magento2/blob/b366da/app/code/Magento/Backend/App/Action/Plugin/Authentication.php#L222-L240


protected function _redirectIfNeededAfterLogin(\Magento\Framework\App\RequestInterface $request)
{
    $requestUri = null;


    // Checks, whether secret key is required for admin access or request uri is explicitly set
    if ($this->_url->useSecretKey()) {
        $requestUri = $this->_url->getUrl('*/*/*', ['_current' => true]);
    } elseif ($request) {
        $requestUri = $request->getRequestUri();
    }


    if (!$requestUri) {
        return false;
    }


    $this->_response->setRedirect($requestUri);
    $this->_actionFlag->set('', \Magento\Framework\App\ActionInterface::FLAG_NO_DISPATCH, true);
    return true;
}

3. \Magento\Backend\Model\Url::getUrl()

4. \Magento\Backend\Model\Auth\Session::processLogin()

github.com

magento/magento2/blob/b366da/app/code/Magento/Backend/Model/Auth/Session.php#L206-L225


/**
 * Process of configuring of current auth storage when login was performed
 *
 * @return \Magento\Backend\Model\Auth\Session
 */
public function processLogin()
{
    if ($this->getUser()) {
        $this->regenerateId();


        if ($this->_backendUrl->useSecretKey()) {
            $this->_backendUrl->renewSecretUrls();
        }


        $this->setIsFirstPageAfterLogin(true);
        $this->setAcl($this->_aclBuilder->getAcl());
        $this->setUpdatedAt(time());
    }
    return $this;
}

5. \Magento\Authorizenet\Controller\Adminhtml\Authorizenet\Directpost\Payment\Place::execute()

github.com

magento/magento2/blob/b366da/app/code/Magento/Authorizenet/Controller/Adminhtml/Authorizenet/Directpost/Payment/Place.php#L108-L114


$adminUrl = $this->_objectManager->get('Magento\Backend\Model\UrlInterface');
if ($adminUrl->useSecretKey()) {
    $requestToAuthorizenet->setKey(
        $adminUrl->getSecretKey('adminhtml', 'authorizenet_directpost_payment', 'redirect')
    );
}
$result['directpost'] = ['fields' => $requestToAuthorizenet->getData()];

dmitrii_fediuk · May 21, 2016, 11:00pm