fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(actions): centralize wave-2 post/csrf guards

Browse Source
This commit is contained in:
Felix Schneider
2026-04-24 18:31:17 +02:00
parent cfd867bcd7
commit da7e7c593e
26 changed files with 237 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pages/admin/settings/expire-remember-tokens().php
View File

@@ -3,7 +3,6 @@
use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Router;
use MintyPHP\Service\Access\SettingsAuthorizationPolicy;
use MintyPHP\Session;
use MintyPHP\Support\Flash;
use MintyPHP\Support\Guard;
@@ -19,15 +18,12 @@ if (!$decision->isAllowed()) {
Guard::deny();
}
if (requestInput()->method() !== 'POST') {
Router::redirect('admin/settings');
if (!actionRequirePost('admin/settings')) {
return;
}
$errorBag = formErrors();
if (!Session::checkCsrfToken()) {
$errorBag->addGlobal(t('Form expired, please try again'));
flashFormErrors($errorBag, 'admin/settings', 'settings_tokens_expire');
Router::redirect('admin/settings');
if (!actionRequireCsrf('admin/settings', 'admin/settings', 'settings_tokens_expire')) {
return;
}
$rememberMeService = app(\MintyPHP\Service\Auth\RememberMeService::class);

5
pages/admin/settings/index().php
View File

@@ -5,7 +5,6 @@ use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Router;
use MintyPHP\Service\Access\SettingsAuthorizationPolicy;
use MintyPHP\Service\Settings\AdminSettingsService;
use MintyPHP\Session;
use MintyPHP\Support\Flash;
use MintyPHP\Support\Guard;
@@ -34,9 +33,7 @@ $settings = is_array($pageData['settings'] ?? null) ? $pageData['settings'] : []
$activeLoginTokens = (int) ($pageData['active_login_tokens'] ?? 0);
$activeApiTokens = (int) ($pageData['active_api_tokens'] ?? 0);
if ($request->isMethod('POST') && !Session::checkCsrfToken()) {
Flash::error(t('Form expired, please try again'), 'admin/settings', 'csrf_expired');
Router::redirect('admin/settings');
if ($request->isMethod('POST') && !actionRequireCsrf('admin/settings', 'admin/settings', 'csrf_expired')) {
return;
}

12
pages/admin/settings/revoke-api-tokens().php
View File

@@ -3,7 +3,6 @@
use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Router;
use MintyPHP\Service\Access\SettingsAuthorizationPolicy;
use MintyPHP\Session;
use MintyPHP\Support\Flash;
use MintyPHP\Support\Guard;
@@ -19,15 +18,12 @@ if (!$decision->isAllowed()) {
Guard::deny();
}
if (requestInput()->method() !== 'POST') {
Router::redirect('admin/settings');
if (!actionRequirePost('admin/settings')) {
return;
}
$errorBag = formErrors();
if (!Session::checkCsrfToken()) {
$errorBag->addGlobal(t('Form expired, please try again'));
flashFormErrors($errorBag, 'admin/settings', 'settings_tokens_revoke');
Router::redirect('admin/settings');
if (!actionRequireCsrf('admin/settings', 'admin/settings', 'settings_tokens_revoke')) {
return;
}
$apiTokenService = app(\MintyPHP\Service\Auth\ApiTokenService::class);