Link protection

Presenter.php

<?php

public function link($destination, $args = array())
	{
		if(!is_array($args)) {
			$args = func_get_args();
			array_shift($args);
		}

		$a = strpos($destination, '#');
		if ($a === FALSE) {
			$fragment = '';
		} else {
			$fragment = substr($destination, $a);
			$destination = substr($destination, 0, $a);
		}

		if (substr($destination, -1) === '!' && strpos($destination, '-') === FALSE) {
			$ref = $this->getReflection()->getMethod($this->formatSignalMethod(rtrim($destination, '!')));
			if(!$ref->getAnnotation('notoken')) {
				static $session;
				if ($session === NULL) {
					$session = $this->getContext()->session->getSection($this->reflection->getName());
				}

				$field = 'signal' . rtrim($destination, '!');
				if (!isset($session->$field))
					$session->$field = $token = base_convert(md5(uniqid($field, TRUE)), 16, 36);
				else
					$token = $session->$field;

				$args['token'] = $token;
			}
		}

		return parent::link($destination . $fragment, $args);
	}

	public function signalReceived($signal)
	{
		static $session;
		if ($session === NULL) {
			$session = $this->getContext()->session->getSection($this->reflection->getName());
		}

		$field = 'signal' . $signal;
		if ((!isset($this->params['token']) || !isset($session->$field) || $session->$field != $this->params['token']) && !$this->getReflection()->getMethod($this->formatSignalMethod($signal))->getAnnotation('notoken')) {
			throw new Avalon\UnauthorizedRequestException('Invalid security token. Please retry your request.');
		}
		
		unset($session->$field, $this->params['token']);
		parent::signalReceived($signal);
	}