1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2019 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <http://www.gnu.org/licenses/>. 16 */ 17declare(strict_types=1); 18 19namespace Fisharebest\Webtrees\Http\Middleware; 20 21use Fig\Http\Message\RequestMethodInterface; 22use Fisharebest\Webtrees\FlashMessages; 23use Fisharebest\Webtrees\I18N; 24use Fisharebest\Webtrees\Session; 25use Psr\Http\Message\ResponseInterface; 26use Psr\Http\Message\ServerRequestInterface; 27use Psr\Http\Server\MiddlewareInterface; 28use Psr\Http\Server\RequestHandlerInterface; 29 30use function in_array; 31 32/** 33 * Middleware to wrap a request in a transaction. 34 */ 35class CheckCsrf implements MiddlewareInterface 36{ 37 private const EXCLUDE_ROUTES = [ 38 'language', 39 'theme', 40 ]; 41 42 /** 43 * @param ServerRequestInterface $request 44 * @param RequestHandlerInterface $handler 45 * 46 * @return ResponseInterface 47 */ 48 public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface 49 { 50 if ($request->getMethod() === RequestMethodInterface::METHOD_POST) { 51 $route = $request->getQueryParams()['route'] ?? ''; 52 53 if (!in_array($route, self::EXCLUDE_ROUTES, true)) { 54 $client_token = $request->getParsedBody()['csrf'] ?? $request->getHeaderLine('X-CSRF-TOKEN'); 55 $session_token = Session::get('CSRF_TOKEN'); 56 57 if ($client_token !== $session_token) { 58 FlashMessages::addMessage(I18N::translate('This form has expired. Try again.')); 59 60 return redirect((string) $request->getUri()); 61 } 62 } 63 } 64 65 return $handler->handle($request); 66 } 67} 68