Add a form key middleware for securing some forms to the sessions on the site.
This commit is contained in:
parent
60025c1089
commit
711441c8ef
@ -15,7 +15,8 @@
|
|||||||
"dotenv-org/phpdotenv-vault": "^0.2.4",
|
"dotenv-org/phpdotenv-vault": "^0.2.4",
|
||||||
"robmorgan/phinx": "^0.16.1",
|
"robmorgan/phinx": "^0.16.1",
|
||||||
"ext-pdo": "*",
|
"ext-pdo": "*",
|
||||||
"react/http": "^1.10"
|
"react/http": "^1.10",
|
||||||
|
"ramsey/uuid": "^4.7"
|
||||||
},
|
},
|
||||||
"require-dev": {
|
"require-dev": {
|
||||||
"phpunit/phpunit": "^11.1",
|
"phpunit/phpunit": "^11.1",
|
||||||
|
|||||||
243
app/composer.lock
generated
243
app/composer.lock
generated
@ -4,8 +4,68 @@
|
|||||||
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
|
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
|
||||||
"This file is @generated automatically"
|
"This file is @generated automatically"
|
||||||
],
|
],
|
||||||
"content-hash": "c800cba133f34decb6f4406860bff411",
|
"content-hash": "2e4b75b6fb46dfcce01fab9906898a73",
|
||||||
"packages": [
|
"packages": [
|
||||||
|
{
|
||||||
|
"name": "brick/math",
|
||||||
|
"version": "0.12.1",
|
||||||
|
"source": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://github.com/brick/math.git",
|
||||||
|
"reference": "f510c0a40911935b77b86859eb5223d58d660df1"
|
||||||
|
},
|
||||||
|
"dist": {
|
||||||
|
"type": "zip",
|
||||||
|
"url": "https://api.github.com/repos/brick/math/zipball/f510c0a40911935b77b86859eb5223d58d660df1",
|
||||||
|
"reference": "f510c0a40911935b77b86859eb5223d58d660df1",
|
||||||
|
"shasum": ""
|
||||||
|
},
|
||||||
|
"require": {
|
||||||
|
"php": "^8.1"
|
||||||
|
},
|
||||||
|
"require-dev": {
|
||||||
|
"php-coveralls/php-coveralls": "^2.2",
|
||||||
|
"phpunit/phpunit": "^10.1",
|
||||||
|
"vimeo/psalm": "5.16.0"
|
||||||
|
},
|
||||||
|
"type": "library",
|
||||||
|
"autoload": {
|
||||||
|
"psr-4": {
|
||||||
|
"Brick\\Math\\": "src/"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"notification-url": "https://packagist.org/downloads/",
|
||||||
|
"license": [
|
||||||
|
"MIT"
|
||||||
|
],
|
||||||
|
"description": "Arbitrary-precision arithmetic library",
|
||||||
|
"keywords": [
|
||||||
|
"Arbitrary-precision",
|
||||||
|
"BigInteger",
|
||||||
|
"BigRational",
|
||||||
|
"arithmetic",
|
||||||
|
"bigdecimal",
|
||||||
|
"bignum",
|
||||||
|
"bignumber",
|
||||||
|
"brick",
|
||||||
|
"decimal",
|
||||||
|
"integer",
|
||||||
|
"math",
|
||||||
|
"mathematics",
|
||||||
|
"rational"
|
||||||
|
],
|
||||||
|
"support": {
|
||||||
|
"issues": "https://github.com/brick/math/issues",
|
||||||
|
"source": "https://github.com/brick/math/tree/0.12.1"
|
||||||
|
},
|
||||||
|
"funding": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/BenMorel",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"time": "2023-11-29T23:19:16+00:00"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"name": "cakephp/chronos",
|
"name": "cakephp/chronos",
|
||||||
"version": "3.1.0",
|
"version": "3.1.0",
|
||||||
@ -2037,6 +2097,187 @@
|
|||||||
},
|
},
|
||||||
"time": "2019-03-08T08:55:37+00:00"
|
"time": "2019-03-08T08:55:37+00:00"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"name": "ramsey/collection",
|
||||||
|
"version": "2.0.0",
|
||||||
|
"source": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://github.com/ramsey/collection.git",
|
||||||
|
"reference": "a4b48764bfbb8f3a6a4d1aeb1a35bb5e9ecac4a5"
|
||||||
|
},
|
||||||
|
"dist": {
|
||||||
|
"type": "zip",
|
||||||
|
"url": "https://api.github.com/repos/ramsey/collection/zipball/a4b48764bfbb8f3a6a4d1aeb1a35bb5e9ecac4a5",
|
||||||
|
"reference": "a4b48764bfbb8f3a6a4d1aeb1a35bb5e9ecac4a5",
|
||||||
|
"shasum": ""
|
||||||
|
},
|
||||||
|
"require": {
|
||||||
|
"php": "^8.1"
|
||||||
|
},
|
||||||
|
"require-dev": {
|
||||||
|
"captainhook/plugin-composer": "^5.3",
|
||||||
|
"ergebnis/composer-normalize": "^2.28.3",
|
||||||
|
"fakerphp/faker": "^1.21",
|
||||||
|
"hamcrest/hamcrest-php": "^2.0",
|
||||||
|
"jangregor/phpstan-prophecy": "^1.0",
|
||||||
|
"mockery/mockery": "^1.5",
|
||||||
|
"php-parallel-lint/php-console-highlighter": "^1.0",
|
||||||
|
"php-parallel-lint/php-parallel-lint": "^1.3",
|
||||||
|
"phpcsstandards/phpcsutils": "^1.0.0-rc1",
|
||||||
|
"phpspec/prophecy-phpunit": "^2.0",
|
||||||
|
"phpstan/extension-installer": "^1.2",
|
||||||
|
"phpstan/phpstan": "^1.9",
|
||||||
|
"phpstan/phpstan-mockery": "^1.1",
|
||||||
|
"phpstan/phpstan-phpunit": "^1.3",
|
||||||
|
"phpunit/phpunit": "^9.5",
|
||||||
|
"psalm/plugin-mockery": "^1.1",
|
||||||
|
"psalm/plugin-phpunit": "^0.18.4",
|
||||||
|
"ramsey/coding-standard": "^2.0.3",
|
||||||
|
"ramsey/conventional-commits": "^1.3",
|
||||||
|
"vimeo/psalm": "^5.4"
|
||||||
|
},
|
||||||
|
"type": "library",
|
||||||
|
"extra": {
|
||||||
|
"captainhook": {
|
||||||
|
"force-install": true
|
||||||
|
},
|
||||||
|
"ramsey/conventional-commits": {
|
||||||
|
"configFile": "conventional-commits.json"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"autoload": {
|
||||||
|
"psr-4": {
|
||||||
|
"Ramsey\\Collection\\": "src/"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"notification-url": "https://packagist.org/downloads/",
|
||||||
|
"license": [
|
||||||
|
"MIT"
|
||||||
|
],
|
||||||
|
"authors": [
|
||||||
|
{
|
||||||
|
"name": "Ben Ramsey",
|
||||||
|
"email": "ben@benramsey.com",
|
||||||
|
"homepage": "https://benramsey.com"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"description": "A PHP library for representing and manipulating collections.",
|
||||||
|
"keywords": [
|
||||||
|
"array",
|
||||||
|
"collection",
|
||||||
|
"hash",
|
||||||
|
"map",
|
||||||
|
"queue",
|
||||||
|
"set"
|
||||||
|
],
|
||||||
|
"support": {
|
||||||
|
"issues": "https://github.com/ramsey/collection/issues",
|
||||||
|
"source": "https://github.com/ramsey/collection/tree/2.0.0"
|
||||||
|
},
|
||||||
|
"funding": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/ramsey",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://tidelift.com/funding/github/packagist/ramsey/collection",
|
||||||
|
"type": "tidelift"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"time": "2022-12-31T21:50:55+00:00"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "ramsey/uuid",
|
||||||
|
"version": "4.7.6",
|
||||||
|
"source": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://github.com/ramsey/uuid.git",
|
||||||
|
"reference": "91039bc1faa45ba123c4328958e620d382ec7088"
|
||||||
|
},
|
||||||
|
"dist": {
|
||||||
|
"type": "zip",
|
||||||
|
"url": "https://api.github.com/repos/ramsey/uuid/zipball/91039bc1faa45ba123c4328958e620d382ec7088",
|
||||||
|
"reference": "91039bc1faa45ba123c4328958e620d382ec7088",
|
||||||
|
"shasum": ""
|
||||||
|
},
|
||||||
|
"require": {
|
||||||
|
"brick/math": "^0.8.8 || ^0.9 || ^0.10 || ^0.11 || ^0.12",
|
||||||
|
"ext-json": "*",
|
||||||
|
"php": "^8.0",
|
||||||
|
"ramsey/collection": "^1.2 || ^2.0"
|
||||||
|
},
|
||||||
|
"replace": {
|
||||||
|
"rhumsaa/uuid": "self.version"
|
||||||
|
},
|
||||||
|
"require-dev": {
|
||||||
|
"captainhook/captainhook": "^5.10",
|
||||||
|
"captainhook/plugin-composer": "^5.3",
|
||||||
|
"dealerdirect/phpcodesniffer-composer-installer": "^0.7.0",
|
||||||
|
"doctrine/annotations": "^1.8",
|
||||||
|
"ergebnis/composer-normalize": "^2.15",
|
||||||
|
"mockery/mockery": "^1.3",
|
||||||
|
"paragonie/random-lib": "^2",
|
||||||
|
"php-mock/php-mock": "^2.2",
|
||||||
|
"php-mock/php-mock-mockery": "^1.3",
|
||||||
|
"php-parallel-lint/php-parallel-lint": "^1.1",
|
||||||
|
"phpbench/phpbench": "^1.0",
|
||||||
|
"phpstan/extension-installer": "^1.1",
|
||||||
|
"phpstan/phpstan": "^1.8",
|
||||||
|
"phpstan/phpstan-mockery": "^1.1",
|
||||||
|
"phpstan/phpstan-phpunit": "^1.1",
|
||||||
|
"phpunit/phpunit": "^8.5 || ^9",
|
||||||
|
"ramsey/composer-repl": "^1.4",
|
||||||
|
"slevomat/coding-standard": "^8.4",
|
||||||
|
"squizlabs/php_codesniffer": "^3.5",
|
||||||
|
"vimeo/psalm": "^4.9"
|
||||||
|
},
|
||||||
|
"suggest": {
|
||||||
|
"ext-bcmath": "Enables faster math with arbitrary-precision integers using BCMath.",
|
||||||
|
"ext-gmp": "Enables faster math with arbitrary-precision integers using GMP.",
|
||||||
|
"ext-uuid": "Enables the use of PeclUuidTimeGenerator and PeclUuidRandomGenerator.",
|
||||||
|
"paragonie/random-lib": "Provides RandomLib for use with the RandomLibAdapter",
|
||||||
|
"ramsey/uuid-doctrine": "Allows the use of Ramsey\\Uuid\\Uuid as Doctrine field type."
|
||||||
|
},
|
||||||
|
"type": "library",
|
||||||
|
"extra": {
|
||||||
|
"captainhook": {
|
||||||
|
"force-install": true
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"autoload": {
|
||||||
|
"files": [
|
||||||
|
"src/functions.php"
|
||||||
|
],
|
||||||
|
"psr-4": {
|
||||||
|
"Ramsey\\Uuid\\": "src/"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"notification-url": "https://packagist.org/downloads/",
|
||||||
|
"license": [
|
||||||
|
"MIT"
|
||||||
|
],
|
||||||
|
"description": "A PHP library for generating and working with universally unique identifiers (UUIDs).",
|
||||||
|
"keywords": [
|
||||||
|
"guid",
|
||||||
|
"identifier",
|
||||||
|
"uuid"
|
||||||
|
],
|
||||||
|
"support": {
|
||||||
|
"issues": "https://github.com/ramsey/uuid/issues",
|
||||||
|
"source": "https://github.com/ramsey/uuid/tree/4.7.6"
|
||||||
|
},
|
||||||
|
"funding": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/ramsey",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://tidelift.com/funding/github/packagist/ramsey/uuid",
|
||||||
|
"type": "tidelift"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"time": "2024-04-27T21:32:50+00:00"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"name": "react/cache",
|
"name": "react/cache",
|
||||||
"version": "v1.2.0",
|
"version": "v1.2.0",
|
||||||
|
|||||||
27
app/src/Middleware/FormKeyMiddleware.php
Normal file
27
app/src/Middleware/FormKeyMiddleware.php
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
<?php
|
||||||
|
|
||||||
|
namespace Slovocast\Middleware;
|
||||||
|
|
||||||
|
use Odan\Session\SessionInterface;
|
||||||
|
use Psr\Http\Server\MiddlewareInterface;
|
||||||
|
use Psr\Http\Server\RequestHandlerInterface as RequestHandler;
|
||||||
|
use Psr\Http\Message\ServerRequestInterface as Request;
|
||||||
|
use Psr\Http\Message\ResponseInterface as Response;
|
||||||
|
use Ramsey\Uuid\Uuid;
|
||||||
|
|
||||||
|
class FormKeyMiddleware implements MiddlewareInterface
|
||||||
|
{
|
||||||
|
public function __construct(
|
||||||
|
private SessionInterface $session
|
||||||
|
) { }
|
||||||
|
|
||||||
|
public function process(Request $request, RequestHandler $handler): Response
|
||||||
|
{
|
||||||
|
if (!$this->session->has("form_key")) {
|
||||||
|
$uuid = Uuid::uuid4();
|
||||||
|
$this->session->set("form_key", $uuid->toString());
|
||||||
|
}
|
||||||
|
|
||||||
|
return $handler->handle($request);
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -5,20 +5,13 @@
|
|||||||
<form action="/channel/create" method="post">
|
<form action="/channel/create" method="post">
|
||||||
<input name="form_key" type="hidden" value="{{ form_key }}">
|
<input name="form_key" type="hidden" value="{{ form_key }}">
|
||||||
<div>
|
<div>
|
||||||
<label for="name">Name<br>
|
<label for="name">Channel Name<br>
|
||||||
<input name="name" type="text" required>
|
<input name="name" type="text" required>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div>
|
<div>
|
||||||
<label for="email">Email<br>
|
<label for="description">Description<br>
|
||||||
<input name="email" type="text" required>
|
<textarea name="description"></textarea>
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
<label for="password">Password<br>
|
|
||||||
<input name="password" type="password" required>
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
<label for="check_password">Confirm Password<br>
|
|
||||||
<input name="check_password" type="password" required>
|
|
||||||
</div>
|
</div>
|
||||||
<div>
|
<div>
|
||||||
<button type="submit" label="Submit">
|
<button type="submit" label="Submit">
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user