Autres/RaspAP
1
0
Fork 0
mirror of https://github.com/billz/raspap-webgui.git synced 2025-07-16 01:27:41 +02:00
Code Issues Releases Wiki Activity

Add validateRequest(), token check outside class

Browse Source
This commit is contained in:
billz 2025-03-26 04:00:34 -07:00
parent d6c8ac32a7
commit 484b89718a
1 changed files with 28 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
includes/CSRF.php
View File

@ -6,7 +6,12 @@ class CSRF
{ {
protected static ?CSRFTokenizer $instance = null; protected static ?CSRFTokenizer $instance = null;
protected static function getInstance(): CSRFTokenizer /*
* Get the CSRFTokenizer instance (singleton)
*
* @return CSRFTokenizer
*/
public static function instance(): CSRFTokenizer
{ {
if (self::$instance === null) { if (self::$instance === null) {
self::$instance = new CSRFTokenizer(); self::$instance = new CSRFTokenizer();
@ -21,22 +26,41 @@ class CSRF
public static function verify(): bool public static function verify(): bool
{ {
return self::instance()->csrfValidateRequest() && self::instance()->CSRFValidate($_POST['csrf_token'] ?? ''); $token = $_POST['csrf_token'];
return self::instance()->csrfValidateRequest() &&
self::instance()->CSRFValidate($_POST['csrf_token'] ?? '');
} }
public static function metaTag(): string public static function metaTag(): string
{ {
return self::getInstance()->CSRFMetaTag(); return self::instance()->CSRFMetaTag();
} }
public static function hiddenField(): string public static function hiddenField(): string
{ {
return self::getInstance()->CSRFTokenFieldTag(); return self::instance()->CSRFTokenFieldTag();
} }
public static function handleInvalidToken(): void public static function handleInvalidToken(): void
{ {
self::instance()->handleInvalidCSRFToken(); self::instance()->handleInvalidCSRFToken();
} }
/**
* Validates a CSRF Request
*
* @return bool
*/
public static function validateRequest(): bool
{
return self::instance()->csrfValidateRequest();
}
}
if (\RaspAP\Tokens\CSRF::validateRequest()) {
if (!\RaspAP\Tokens\CSRF::verify()) {
error_log("CSRF verification failed. Token: " . ($_POST['csrf_token'] ?? 'not provided'));
\RaspAP\Tokens\CSRF::handleInvalidToken();
}
} }