Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <?php
- namespace App\Http\Middleware;
- use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
- use Closure;
- use Illuminate\Support\Str;
- use Symfony\Component\HttpFoundation\Cookie;
- use Illuminate\Contracts\Encryption\Encrypter;
- use Illuminate\Session\TokenMismatchException;
- class VerifyCsrfToken extends BaseVerifier
- {
- /**
- * The encrypter implementation.
- *
- * @var \Illuminate\Contracts\Encryption\Encrypter
- */
- protected $encrypter;
- /**
- * The URIs that should be excluded from CSRF verification.
- *
- * @var array
- */
- protected $except = [
- //
- ];
- /**
- * Create a new middleware instance.
- *
- * @param \Illuminate\Contracts\Encryption\Encrypter $encrypter
- * @return void
- */
- public function __construct(Encrypter $encrypter)
- {
- $this->encrypter = $encrypter;
- }
- /**
- * @param \Illuminate\Http\Request $request
- * @param Closure $next
- * @return \Illuminate\Http\Response
- */
- public function handle($request, Closure $next )
- {
- if (
- $this->isReading($request) ||
- #$this->runningUnitTests() ||
- $this->shouldPassThrough($request) ||
- $this->tokensMatch($request) )
- {
- return $this->addCookieToResponse($request, $next($request));
- }
- #throw new TokenMismatchException;
- return Redirect::back()->withError('Sorry, we could not verify your request. Please try again.');
- }
- /**
- * Determine if the request has a URI that should pass through CSRF verification.
- *
- * @param \Illuminate\Http\Request $request
- * @return bool
- */
- protected function shouldPassThrough($request)
- {
- foreach ($this->except as $except) {
- if ($request->is($except)) {
- return true;
- }
- }
- return false;
- }
- /**
- * Determine if the session and input CSRF tokens match.
- *
- * @param \Illuminate\Http\Request $request
- * @return bool
- */
- protected function tokensMatch($request)
- {
- $token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');
- if (! $token && $header = $request->header('X-XSRF-TOKEN')) {
- $token = $this->encrypter->decrypt($header);
- }
- return Str::equals($request->session()->token(), $token);
- }
- /**
- * Add the CSRF token to the response cookies.
- *
- * @param \Illuminate\Http\Request $request
- * @param \Illuminate\Http\Response $response
- * @return \Illuminate\Http\Response
- */
- protected function addCookieToResponse($request, $response)
- {
- $config = config('session');
- $response->headers->setCookie(
- new Cookie(
- 'XSRF-TOKEN', $request->session()->token(), time() + 60 * 120,
- $config['path'], $config['domain'], false, false
- )
- );
- return $response;
- }
- /**
- * Determine if the HTTP request uses a ‘read’ verb.
- *
- * @param \Illuminate\Http\Request $request
- * @return bool
- */
- protected function isReading($request)
- {
- return in_array($request->method(), ['HEAD', 'GET', 'OPTIONS']);
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment