protected function _debugPostTokenNotMatching(Controller $controller, $hashParts)
    {
        $messages = [];
        $expectedParts = json_decode(urldecode($controller->getRequest()->getData('_Token.debug')), true);
        if (!is_array($expectedParts) || count($expectedParts) !== 3) {
            return 'Invalid security debug token.';
        }
        $expectedUrl = Hash::get($expectedParts, 0);
        $url = Hash::get($hashParts, 0);
        if ($expectedUrl !== $url) {
            $messages[] = sprintf('URL mismatch in POST data (expected \'%s\' but found \'%s\')', $expectedUrl, $url);
        }
        $expectedFields = Hash::get($expectedParts, 1);
        $dataFields = Hash::get($hashParts, 1);
        if ($dataFields) {
            $dataFields = unserialize($dataFields);
        }
        $fieldsMessages = $this->_debugCheckFields(
            $dataFields,
            $expectedFields,
            'Unexpected field \'%s\' in POST data',
            'Tampered field \'%s\' in POST data (expected value \'%s\' but found \'%s\')',
            'Missing field \'%s\' in POST data'
        );
        $expectedUnlockedFields = Hash::get($expectedParts, 2);
        $dataUnlockedFields = Hash::get($hashParts, 2) ?: null;
        if ($dataUnlockedFields) {
            $dataUnlockedFields = explode('|', $dataUnlockedFields);
        }
        $unlockFieldsMessages = $this->_debugCheckFields(
            (array)$dataUnlockedFields,
            $expectedUnlockedFields,
            'Unexpected unlocked field \'%s\' in POST data',
            null,
            'Missing unlocked field: \'%s\''
        );

        $messages = array_merge($messages, $fieldsMessages, $unlockFieldsMessages);

        return implode(', ', $messages);
    }
protected function _debugPostTokenNotMatching(Controller $controller, $hashParts)
    {
        $messages = [];
        $expectedParts = json_decode(urldecode($controller->getRequest()->getData('_Token.debug')), true);
        if (!is_array($expectedParts) || count($expectedParts) !== 3) {
            return 'Invalid security debug token.';
        }
        $expectedUrl = Hash::get($expectedParts, 0);
        $url = Hash::get($hashParts, 0);
        if ($expectedUrl !== $url) {
            $messages[] = sprintf('URL mismatch in POST data (expected \'%s\' but found \'%s\')', $expectedUrl, $url);
        }
        $expectedFields = Hash::get($expectedParts, 1);
        $dataFields = Hash::get($hashParts, 1);
        if ($dataFields) {
            $dataFields = unserialize($dataFields);
        }
        $fieldsMessages = $this->_debugCheckFields(
            $dataFields,
            $expectedFields,
            'Unexpected field \'%s\' in POST data',
            'Tampered field \'%s\' in POST data (expected value \'%s\' but found \'%s\')',
            'Missing field \'%s\' in POST data'
        );
        $expectedUnlockedFields = Hash::get($expectedParts, 2);
        $dataUnlockedFields = Hash::get($hashParts, 2) ?: null;
        if ($dataUnlockedFields) {
            $dataUnlockedFields = explode('|', $dataUnlockedFields);
        }
        $unlockFieldsMessages = $this->_debugCheckFields(
            (array)$dataUnlockedFields,
            $expectedUnlockedFields,
            'Unexpected unlocked field \'%s\' in POST data',
            null,
            'Missing unlocked field: \'%s\''
        );

        $messages = array_merge($messages, $fieldsMessages, $unlockFieldsMessages);

        return implode(', ', $messages);
    }
protected function _debugPostTokenNotMatching ( Controller $ controller , $ hashParts ) { $ messages = [ ] ; $ expectedParts = json_decode ( urldecode ( $ controller -> getRequest ( ) -> getData ( '_Token.debug' ) ) , true ) ; if ( ! is_array ( $ expectedParts ) || count ( $ expectedParts ) !== 3 ) { return 'Invalid security debug token.' ; } $ expectedUrl = Hash :: get ( $ expectedParts , 0 ) ; $ url = Hash :: get ( $ hashParts , 0 ) ; if ( $ expectedUrl !== $ url ) { $ messages [ ] = sprintf ( 'URL mismatch in POST data (expected \'%s\' but found \'%s\')' , $ expectedUrl , $ url ) ; } $ expectedFields = Hash :: get ( $ expectedParts , 1 ) ; $ dataFields = Hash :: get ( $ hashParts , 1 ) ; if ( $ dataFields ) { $ dataFields = unserialize ( $ dataFields ) ; } $ fieldsMessages = $ this -> _debugCheckFields ( $ dataFields , $ expectedFields , 'Unexpected field \'%s\' in POST data' , 'Tampered field \'%s\' in POST data (expected value \'%s\' but found \'%s\')' , 'Missing field \'%s\' in POST data' ) ; $ expectedUnlockedFields = Hash :: get ( $ expectedParts , 2 ) ; $ dataUnlockedFields = Hash :: get ( $ hashParts , 2 ) ? : null ; if ( $ dataUnlockedFields ) { $ dataUnlockedFields = explode ( '|' , $ dataUnlockedFields ) ; } $ unlockFieldsMessages = $ this -> _debugCheckFields ( ( array ) $ dataUnlockedFields , $ expectedUnlockedFields , 'Unexpected unlocked field \'%s\' in POST data' , null , 'Missing unlocked field: \'%s\'' ) ; $ messages = array_merge ( $ messages , $ fieldsMessages , $ unlockFieldsMessages ) ; return implode ( ', ' , $ messages ) ; }
Create a message for humans to understand why Security token is not matching

@param \Cake\Controller\Controller $controller Instantiating controller
@param array $hashParts Elements used to generate the Token hash
@return string Message explaining why the tokens are not matching
Create a message for humans to understand why Security token is not matching