geckon01/simple-php-router
1
0
Fork 0
mirror of https://github.com/skipperbent/simple-php-router.git synced 2026-06-17 08:47:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #649 from skipperbent/feature-csrfverifier

Browse Source 
[!!!] CsrfVerifier changes
This commit is contained in:
Simon Sessingø
2023-04-07 14:36:13 +02:00
committed by GitHub
parent c635771fcd 6c6d81d3c9
commit ebf9224407
2 changed files with 26 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Pecee/Http/Middleware/BaseCsrfVerifier.php
+24 -19
View File
@@ -17,13 +17,13 @@ class BaseCsrfVerifier implements IMiddleware
* For example: /admin/* * For example: /admin/*
* @var array|null * @var array|null
*/ */
protected ?array $except = null; protected array $except = [];
/** /**
* Urls to include. Can be used to include urls from a certain path. * Urls to include. Can be used to include urls from a certain path.
* @var array|null * @var array|null
*/ */
protected ?array $include = null; protected array $include = [];
/** /**
* @var ITokenProvider * @var ITokenProvider
@@ -38,6 +38,23 @@ class BaseCsrfVerifier implements IMiddleware
$this->tokenProvider = new CookieTokenProvider(); $this->tokenProvider = new CookieTokenProvider();
} }
protected function isIncluded(Request $request): bool
{
if (count($this->include) > 0) {
foreach ($this->include as $includeUrl) {
$includeUrl = rtrim($includeUrl, '/');
if ($includeUrl[strlen($includeUrl) - 1] === '*') {
$includeUrl = rtrim($includeUrl, '*');
return $request->getUrl()->contains($includeUrl);
}
return ($includeUrl === rtrim($request->getUrl()->getRelativeUrl(false), '/'));
}
}
return false;
}
/** /**
* Check if the url matches the urls in the except property * Check if the url matches the urls in the except property
* @param Request $request * @param Request $request
@@ -45,11 +62,11 @@ class BaseCsrfVerifier implements IMiddleware
*/ */
protected function skip(Request $request): bool protected function skip(Request $request): bool
{ {
if ($this->except === null || count($this->except) === 0) { if (count($this->except) === 0) {
return false; return false;
} }
foreach($this->except as $url) { foreach ($this->except as $url) {
$url = rtrim($url, '/'); $url = rtrim($url, '/');
if ($url[strlen($url) - 1] === '*') { if ($url[strlen($url) - 1] === '*') {
$url = rtrim($url, '*'); $url = rtrim($url, '*');
@@ -60,20 +77,9 @@ class BaseCsrfVerifier implements IMiddleware
if ($skip === true) { if ($skip === true) {
if(is_array($this->include) === true && count($this->include) > 0) { $skip = !$this->isIncluded($request);
foreach($this->include as $includeUrl) {
$includeUrl = rtrim($includeUrl, '/');
if ($includeUrl[strlen($includeUrl) - 1] === '*') {
$includeUrl = rtrim($includeUrl, '*');
$skip = !$request->getUrl()->contains($includeUrl);
break;
}
$skip = !($includeUrl === rtrim($request->getUrl()->getRelativeUrl(false), '/')); if ($skip === false) {
}
}
if($skip === false) {
continue; continue;
} }
@@ -92,12 +98,11 @@ class BaseCsrfVerifier implements IMiddleware
*/ */
public function handle(Request $request): void public function handle(Request $request): void
{ {
if ($this->skip($request) === false && $request->isPostBack() === true) { if ($this->skip($request) === false && ($request->isPostBack() === true || $this->isIncluded($request) === true)) {
$token = $request->getInputHandler()->value( $token = $request->getInputHandler()->value(
static::POST_KEY, static::POST_KEY,
$request->getHeader(static::HEADER_KEY), $request->getHeader(static::HEADER_KEY),
Request::$requestTypesPost
); );
if ($this->tokenProvider->validate((string)$token) === false) { if ($this->tokenProvider->validate((string)$token) === false) {
tests/Pecee/SimpleRouter/Dummy/CsrfVerifier/DummyCsrfVerifier.php
+2 -2
View File
@@ -2,12 +2,12 @@
class DummyCsrfVerifier extends \Pecee\Http\Middleware\BaseCsrfVerifier { class DummyCsrfVerifier extends \Pecee\Http\Middleware\BaseCsrfVerifier {
protected ?array $except = [ protected array $except = [
'/exclude-page', '/exclude-page',
'/exclude-all/*', '/exclude-all/*',
]; ];
protected ?array $include = [ protected array $include = [
'/exclude-all/include-page', '/exclude-all/include-page',
]; ];