selimppc

class VerifyCsrfToken in Laravel 5.1

Aug 30th, 2016
181
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 3.35 KB | None | 0 0
  1. <?php
  2.  
  3. namespace App\Http\Middleware;
  4.  
  5. use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
  6. use Closure;
  7. use Illuminate\Support\Str;
  8. use Symfony\Component\HttpFoundation\Cookie;
  9. use Illuminate\Contracts\Encryption\Encrypter;
  10. use Illuminate\Session\TokenMismatchException;
  11.  
  12. class VerifyCsrfToken extends BaseVerifier
  13. {
  14.     /**
  15.      * The encrypter implementation.
  16.      *
  17.      * @var \Illuminate\Contracts\Encryption\Encrypter
  18.      */
  19.     protected $encrypter;
  20.  
  21.     /**
  22.      * The URIs that should be excluded from CSRF verification.
  23.      *
  24.      * @var array
  25.      */
  26.     protected $except = [
  27.         //
  28.     ];
  29.  
  30.     /**
  31.      * Create a new middleware instance.
  32.      *
  33.      * @param  \Illuminate\Contracts\Encryption\Encrypter  $encrypter
  34.      * @return void
  35.      */
  36.     public function __construct(Encrypter $encrypter)
  37.     {
  38.         $this->encrypter = $encrypter;
  39.     }
  40.  
  41.     /**
  42.      * @param \Illuminate\Http\Request $request
  43.      * @param Closure $next
  44.      * @return \Illuminate\Http\Response
  45.      */
  46.     public function handle($request, Closure $next )
  47.     {
  48.         if (
  49.             $this->isReading($request) ||
  50.             #$this->runningUnitTests() ||
  51.            $this->shouldPassThrough($request) ||
  52.             $this->tokensMatch($request) )
  53.         {
  54.             return $this->addCookieToResponse($request, $next($request));
  55.         }
  56.  
  57.         #throw new TokenMismatchException;
  58.  
  59.         return Redirect::back()->withError('Sorry, we could not verify your request. Please try again.');
  60.     }
  61.  
  62.     /**
  63.      * Determine if the request has a URI that should pass through CSRF verification.
  64.      *
  65.      * @param  \Illuminate\Http\Request  $request
  66.      * @return bool
  67.      */
  68.     protected function shouldPassThrough($request)
  69.     {
  70.         foreach ($this->except as $except) {
  71.             if ($request->is($except)) {
  72.                 return true;
  73.             }
  74.         }
  75.  
  76.         return false;
  77.     }
  78.  
  79.     /**
  80.      * Determine if the session and input CSRF tokens match.
  81.      *
  82.      * @param  \Illuminate\Http\Request  $request
  83.      * @return bool
  84.      */
  85.     protected function tokensMatch($request)
  86.     {
  87.         $token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');
  88.  
  89.         if (! $token && $header = $request->header('X-XSRF-TOKEN')) {
  90.             $token = $this->encrypter->decrypt($header);
  91.         }
  92.  
  93.         return Str::equals($request->session()->token(), $token);
  94.     }
  95.  
  96.     /**
  97.      * Add the CSRF token to the response cookies.
  98.      *
  99.      * @param  \Illuminate\Http\Request  $request
  100.      * @param  \Illuminate\Http\Response  $response
  101.      * @return \Illuminate\Http\Response
  102.      */
  103.     protected function addCookieToResponse($request, $response)
  104.     {
  105.         $config = config('session');
  106.  
  107.         $response->headers->setCookie(
  108.             new Cookie(
  109.                 'XSRF-TOKEN', $request->session()->token(), time() + 60 * 120,
  110.                 $config['path'], $config['domain'], false, false
  111.             )
  112.         );
  113.  
  114.         return $response;
  115.     }
  116.  
  117.     /**
  118.      * Determine if the HTTP request uses a ‘read’ verb.
  119.      *
  120.      * @param  \Illuminate\Http\Request  $request
  121.      * @return bool
  122.      */
  123.     protected function isReading($request)
  124.     {
  125.         return in_array($request->method(), ['HEAD', 'GET', 'OPTIONS']);
  126.     }
  127. }
Advertisement
Add Comment
Please, Sign In to add comment