File Manager

✏️ Edit File: /home/u625410797/public_html/public_html/includes/middleware/CsrfMiddleware.php

<?php
/**
 * Monothailand PHP Version - CSRF Protection Middleware
 * ============================================================
 * Validates CSRF tokens for state-changing requests
 */

if (!defined('MONO_APP')) {
    define('MONO_APP', true);
}

class CsrfMiddleware {
    /**
     * Handle CSRF token validation
     * @param array $params Route parameters
     * @return bool True if valid, false otherwise
     */
    public static function handle($params = []) {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
        
        // Generate CSRF token if not exists
        if (!isset($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        
        // Validate CSRF token for POST/PUT/DELETE requests
        $method = $_SERVER['REQUEST_METHOD'] ?? '';
        
        if (in_array($method, ['POST', 'PUT', 'DELETE', 'PATCH'])) {
            // Get token from POST data, header, or JSON body
            $token = $_POST['_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? null;
            
            // If no token in POST/header, try to parse from JSON body
            if (!$token && $method === 'POST') {
                $rawInput = file_get_contents('php://input');
                $data = json_decode($rawInput, true);
                $token = $data['_token'] ?? null;
            }
            
            // Validate token
            if (!$token || !hash_equals($_SESSION['csrf_token'], $token)) {
                http_response_code(403);
                if (isset($_SERVER['HTTP_ACCEPT']) && strpos($_SERVER['HTTP_ACCEPT'], 'application/json') !== false) {
                    header('Content-Type: application/json');
                    echo json_encode([
                        'success' => false,
                        'error' => 'CSRF token validation failed'
                    ]);
                } else {
                    echo '<h1>403 - Forbidden</h1>';
                    echo '<p>CSRF token validation failed. Please refresh the page and try again.</p>';
                }
                exit;
            }
        }
        
        return true;
    }
    
    /**
     * Generate a new CSRF token
     * @return string CSRF token
     */
    public static function generateToken() {
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
        
        if (!isset($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        
        return $_SESSION['csrf_token'];
    }
    
    /**
     * Get the current CSRF token (for use in forms)
     * @return string CSRF token
     */
    public static function getToken() {
        return self::generateToken();
    }
}
?>

Batal

⬅ Naik ke includes 4 item

Nama	Tipe	Ukuran	Diubah	Aksi
🐘AuthMiddleware.php	php	1.5 KB	2026-05-31 16:42	✏️ Edit 👁️ View
🐘CartMiddleware.php	php	3.6 KB	2026-05-31 16:42	✏️ Edit 👁️ View
🐘CsrfMiddleware.php	php	2.7 KB	2026-05-31 16:42	✏️ Edit 👁️ View
🐘RateLimitMiddleware.php	php	3.7 KB	2026-05-31 16:42	✏️ Edit 👁️ View