src/CsrfMiddleware.php
public function call() {
		if ( !isset( $_SESSION[self::PARAM] ) ) {
			$_SESSION[self::PARAM] = sha1( session_id() . microtime() );
		}

		$token = $_SESSION[self::PARAM];
		$method = $this->app->request()->getMethod();

		if ( in_array( $method, [ 'POST', 'PUT', 'DELETE' ] ) ) {
			$requestToken = $this->app->request()->post( self::PARAM );
			if ( $token !== $requestToken ) {
				$this->app->log->error( 'Missing or invalid CSRF token', [
					'got' => $requestToken,
					'expected' => $token,
				] );
				$this->app->render( 'csrf.html', [], 400 );
				return;
			}
		}

		$this->app->view()->replace( [
			'csrf_param' => self::PARAM,
			'csrf_token' => $token,
		] );

		$this->next->call();
	}
public function call() {
		if ( !isset( $_SESSION[self::PARAM] ) ) {
			$_SESSION[self::PARAM] = sha1( session_id() . microtime() );
		}

		$token = $_SESSION[self::PARAM];
		$method = $this->app->request()->getMethod();

		if ( in_array( $method, [ 'POST', 'PUT', 'DELETE' ] ) ) {
			$requestToken = $this->app->request()->post( self::PARAM );
			if ( $token !== $requestToken ) {
				$this->app->log->error( 'Missing or invalid CSRF token', [
					'got' => $requestToken,
					'expected' => $token,
				] );
				$this->app->render( 'csrf.html', [], 400 );
				return;
			}
		}

		$this->app->view()->replace( [
			'csrf_param' => self::PARAM,
			'csrf_token' => $token,
		] );

		$this->next->call();
	}
public function call ( ) { if ( ! isset ( $ _SESSION [ self :: PARAM ] ) ) { $ _SESSION [ self :: PARAM ] = sha1 ( session_id ( ) . microtime ( ) ) ; } $ token = $ _SESSION [ self :: PARAM ] ; $ method = $ this -> app -> request ( ) -> getMethod ( ) ; if ( in_array ( $ method , [ 'POST' , 'PUT' , 'DELETE' ] ) ) { $ requestToken = $ this -> app -> request ( ) -> post ( self :: PARAM ) ; if ( $ token !== $ requestToken ) { $ this -> app -> log -> error ( 'Missing or invalid CSRF token' , [ 'got' => $ requestToken , 'expected' => $ token , ] ) ; $ this -> app -> render ( 'csrf.html' , [ ] , 400 ) ; return ; } } $ this -> app -> view ( ) -> replace ( [ 'csrf_param' => self :: PARAM , 'csrf_token' => $ token , ] ) ; $ this -> next -> call ( ) ; }
Handle CSRF validation and view injection.
Handle CSRF validation and view injection .