function backdrop_valid_autocomplete_token

Validates the token provided with the current autocomplete request.

Autocomplete requests are made to the autocomplete path followed by the search string, such as 'user/autocomplete/search-string'. Because the search string may itself contain slashes, the token is compared against each leading portion of the current path.

This function should be called from the access callback of autocomplete menu items, in addition to any other access checks. This prevents autocomplete callbacks from being accessed directly without first visiting a form that contains an autocomplete field for that path. For example:

function my_module_menu() {
  $items['my_module/autocomplete'] = array(
    'page callback' => 'my_module_autocomplete',
    'access callback' => 'my_module_autocomplete_access',
    'type' => MENU_CALLBACK,
  );
  return $items;
}

function my_module_autocomplete_access() {
  return user_access('access content') && backdrop_valid_autocomplete_token();
}

@since 1.35.2 Function added.

Return value

bool: TRUE if the "token" query parameter is valid for the current path, FALSE otherwise.

See also

backdrop_get_autocomplete_token()

File

core/includes/common.inc, line 6588

Common functions that many Backdrop modules will need to reference.

Code

function backdrop_valid_autocomplete_token() {
  if (!isset($_GET['token']) || !is_string($_GET['token']) || !isset($_GET['q'])) {
    return FALSE;
  }
  $parts = explode('/', trim($_GET['q'], '/'));
  while ($parts) {
    if (hash_equals(backdrop_get_autocomplete_token(implode('/', $parts)), $_GET['token'])) {
      return TRUE;
    }
    array_pop($parts);
  }
  return FALSE;
}