fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(actions): centralize wave-2 post/csrf guards

Browse Source
This commit is contained in:
Felix Schneider
2026-04-24 18:31:17 +02:00
parent cfd867bcd7
commit da7e7c593e
26 changed files with 237 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pages/admin/users/access-pdf($id).php
View File

@@ -4,7 +4,6 @@ use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Router;
use MintyPHP\Service\Access\UserAuthorizationPolicy;
use MintyPHP\Service\User\UserAccessPdfService;
use MintyPHP\Session;
use MintyPHP\Support\Guard;
$session = app(SessionStoreInterface::class)->all();
@@ -15,22 +14,20 @@ Guard::requireLogin();
$authorizationService = app(\MintyPHP\Service\Access\AuthorizationService::class);
$userAccountService = app(\MintyPHP\Service\User\UserAccountService::class);
$userAccessPdfService = app(UserAccessPdfService::class);
$request = requestInput();
$errorBag = formErrors();
// Support both route param and POSTed uuid (POST avoids exposing uuid in URL/history).
$uuid = trim((string) ($id ?? ''));
if ($uuid === '' && strtoupper((string) (requestInput()->method())) === 'POST') {
if (!Session::checkCsrfToken()) {
$errorBag->addGlobal(t('Form expired, please try again'));
flashFormErrors($errorBag, 'admin/users', 'users_access_pdf');
Router::redirect('admin/users');
if ($uuid === '' && $request->isMethod('POST')) {
if (!actionRequireCsrf('admin/users', 'admin/users', 'users_access_pdf')) {
return;
}
$uuid = trim((string) (requestInput()->bodyAll()['uuid'] ?? ''));
$uuid = trim((string) ($request->bodyAll()['uuid'] ?? ''));
}
$user = $uuid !== '' ? $userAccountService->findByUuid($uuid) : null;
if (!$user) {
if (strtoupper((string) (requestInput()->method())) === 'POST') {
if ($request->isMethod('POST')) {
$errorBag->addGlobal(t('User not found'));
flashFormErrors($errorBag, 'admin/users', 'users_access_pdf');
Router::redirect('admin/users');

9
pages/admin/users/access-pdf-bulk().php
View File

@@ -4,8 +4,6 @@ use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Router;
use MintyPHP\Service\Access\UserAuthorizationPolicy;
use MintyPHP\Service\User\UserAccessPdfService;
use MintyPHP\Session;
use MintyPHP\Support\Flash;
use MintyPHP\Support\Guard;
$session = app(SessionStoreInterface::class)->all();
@@ -24,14 +22,11 @@ if (!$decision->isAllowed()) {
$userAccountService = app(\MintyPHP\Service\User\UserAccountService::class);
$userAccessPdfService = app(UserAccessPdfService::class);
if (strtoupper((string) (requestInput()->method())) !== 'POST') {
Router::redirect('admin/users');
if (!actionRequirePost('admin/users')) {
return;
}
if (!Session::checkCsrfToken()) {
Flash::error(t('Form expired, please try again'), 'admin/users', 'csrf_expired');
Router::redirect('admin/users');
if (!actionRequireCsrf('admin/users', 'admin/users', 'csrf_expired')) {
return;
}

5
pages/admin/users/edit($id).php
View File

@@ -8,7 +8,6 @@ use MintyPHP\Repository\Auth\RememberTokenRepository;
use MintyPHP\Router;
use MintyPHP\Service\Access\UserAuthorizationPolicy;
use MintyPHP\Service\CustomField\UserCustomFieldValueService;
use MintyPHP\Session;
use MintyPHP\Support\Flash;
use MintyPHP\Support\Guard;
@@ -155,9 +154,7 @@ if ($canViewSecurityArtifacts) {
$canManageApiTokens = $canManageApiTokens && $canViewSecurityArtifacts;
$showApiTokens = $canViewSecurityArtifacts;
if ($request->isMethod('POST') && !Session::checkCsrfToken()) {
Flash::error(t('Form expired, please try again'), $editTarget, 'csrf_expired');
Router::redirect($editTarget);
if ($request->isMethod('POST') && !actionRequireCsrf($editTarget, $editTarget, 'csrf_expired')) {
return;
}