1<?php 2/** 3 * webtrees: online genealogy 4 * Copyright (C) 2019 webtrees development team 5 * This program is free software: you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, either version 3 of the License, or 8 * (at your option) any later version. 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * You should have received a copy of the GNU General Public License 14 * along with this program. If not, see <http://www.gnu.org/licenses/>. 15 */ 16declare(strict_types=1); 17 18namespace Fisharebest\Webtrees\Http\Middleware; 19 20use Fig\Http\Message\RequestMethodInterface; 21use Fisharebest\Webtrees\FlashMessages; 22use Fisharebest\Webtrees\I18N; 23use Fisharebest\Webtrees\Session; 24use Psr\Http\Message\ResponseInterface; 25use Psr\Http\Message\ServerRequestInterface; 26use Psr\Http\Server\MiddlewareInterface; 27use Psr\Http\Server\RequestHandlerInterface; 28use function in_array; 29 30/** 31 * Middleware to wrap a request in a transaction. 32 */ 33class CheckCsrf implements MiddlewareInterface 34{ 35 private const EXCLUDE_ROUTES = [ 36 'language', 37 'theme', 38 ]; 39 40 /** 41 * @param ServerRequestInterface $request 42 * @param RequestHandlerInterface $handler 43 * 44 * @return ResponseInterface 45 */ 46 public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface 47 { 48 if ($request->getMethod() === RequestMethodInterface::METHOD_POST) { 49 $route = $request->getQueryParams()['route'] ?? ''; 50 51 if (!in_array($route, self::EXCLUDE_ROUTES, true)) { 52 $client_token = $request->getParsedBody()['csrf'] ?? $request->getHeaderLine('X-CSRF-TOKEN'); 53 $session_token = Session::get('CSRF_TOKEN'); 54 55 if ($client_token !== $session_token) { 56 FlashMessages::addMessage(I18N::translate('This form has expired. Try again.')); 57 58 return redirect($request->getAttribute('request_uri')); 59 } 60 } 61 } 62 63 return $handler->handle($request); 64 } 65} 66