protected function checkTokenInUrl()
    {
        $tokenRequest = Common::getRequestVar('token_auth', false);
        $tokenUser = Piwik::getCurrentUserTokenAuth();

        if (empty($tokenRequest) && empty($tokenUser)) {
            return; // UI tests
        }

        if ($tokenRequest !== $tokenUser) {
            throw new NoAccessException(Piwik::translate('General_ExceptionInvalidToken'));
        }
    }
protected function checkTokenInUrl()
    {
        $tokenRequest = Common::getRequestVar('token_auth', false);
        $tokenUser = Piwik::getCurrentUserTokenAuth();

        if (empty($tokenRequest) && empty($tokenUser)) {
            return; // UI tests
        }

        if ($tokenRequest !== $tokenUser) {
            throw new NoAccessException(Piwik::translate('General_ExceptionInvalidToken'));
        }
    }
protected function checkTokenInUrl ( ) { $ tokenRequest = Common :: getRequestVar ( 'token_auth' , false ) ; $ tokenUser = Piwik :: getCurrentUserTokenAuth ( ) ; if ( empty ( $ tokenRequest ) && empty ( $ tokenUser ) ) { return ; // UI tests } if ( $ tokenRequest !== $ tokenUser ) { throw new NoAccessException ( Piwik :: translate ( 'General_ExceptionInvalidToken' ) ) ; } }
Checks that the token_auth in the URL matches the currently logged-in user's token_auth.

This is a protection against CSRF and should be used in all controller
methods that modify Piwik or any user settings.

If called from JavaScript by using the `ajaxHelper` you have to call `ajaxHelper.withTokenInUrl();` before
`ajaxHandler.send();` to send the token along with the request.

**The token_auth should never appear in the browser's address bar.**

@throws \Piwik\NoAccessException If the token doesn't match.
@api
Checks that the token_auth in the URL matches the currently logged - in user s token_auth .