Autres/RaspAP
1
0
Fork 0
mirror of https://github.com/billz/raspap-webgui.git synced 2025-07-15 07:57:39 +02:00
Code Issues Releases Wiki Activity

Add validateRequest(), token check outside class

Browse Source
This commit is contained in:
billz 2025-03-26 04:00:34 -07:00
parent d6c8ac32a7
commit 484b89718a
1 changed files with 28 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
includes/CSRF.php
View File

@ -6,7 +6,12 @@ class CSRF
{
protected static ?CSRFTokenizer $instance = null;
protected static function getInstance(): CSRFTokenizer
/*
* Get the CSRFTokenizer instance (singleton)
*
* @return CSRFTokenizer
*/
public static function instance(): CSRFTokenizer
{
if (self::$instance === null) {
self::$instance = new CSRFTokenizer();
@ -21,22 +26,41 @@ class CSRF
public static function verify(): bool
{
return self::instance()->csrfValidateRequest() && self::instance()->CSRFValidate($_POST['csrf_token'] ?? '');
$token = $_POST['csrf_token'];
return self::instance()->csrfValidateRequest() &&
self::instance()->CSRFValidate($_POST['csrf_token'] ?? '');
}
public static function metaTag(): string
{
return self::getInstance()->CSRFMetaTag();
return self::instance()->CSRFMetaTag();
}
public static function hiddenField(): string
{
return self::getInstance()->CSRFTokenFieldTag();
return self::instance()->CSRFTokenFieldTag();
}
public static function handleInvalidToken(): void
{
self::instance()->handleInvalidCSRFToken();
}
/**
* Validates a CSRF Request
*
* @return bool
*/
public static function validateRequest(): bool
{
return self::instance()->csrfValidateRequest();
}
}
if (\RaspAP\Tokens\CSRF::validateRequest()) {
if (!\RaspAP\Tokens\CSRF::verify()) {
error_log("CSRF verification failed. Token: " . ($_POST['csrf_token'] ?? 'not provided'));
\RaspAP\Tokens\CSRF::handleInvalidToken();
}
}