fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(actions): centralize POST/CSRF guard flow

Browse Source
This commit is contained in:
Felix Schneider
2026-04-24 17:59:57 +02:00
parent 87652e55da
commit cfd867bcd7
16 changed files with 175 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pages/admin/users/delete($id).php
View File

@@ -12,8 +12,16 @@ Guard::requireLogin();
$authorizationService = app(\MintyPHP\Service\Access\AuthorizationService::class);
$userAccountService = app(\MintyPHP\Service\User\UserAccountService::class);
if ((requestInput()->method()) !== 'POST') {
Router::redirect('admin/users');
if (!actionRequirePost('admin/users')) {
return;
}
if (!actionRequireCsrf(
'admin/users',
'admin/users',
'user_delete',
jsonAware: true
)) {
return;
}
@@ -26,13 +34,7 @@ $decision = $authorizationService->authorize(UserAuthorizationPolicy::ABILITY_AD
'actor_user_id' => $currentUserId,
'target_user_id' => $userId,
]);
if (!$decision->isAllowed()) {
if (Request::wantsJson()) {
http_response_code($decision->status());
Router::json(['error' => $decision->error()]);
return;
}
Router::redirect('error/forbidden?url=' . urlencode(Request::pathWithQuery()));
if (!actionAllowOrDeny($decision)) {
return;
}
$result = $userAccountService->deleteByUuid($uuid, $currentUserId);