Skip to content

Commit

Permalink
update
Browse files Browse the repository at this point in the history
  • Loading branch information
ncou committed Jun 13, 2021
1 parent ce70bd6 commit f9cdf8c
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 27 deletions.
2 changes: 1 addition & 1 deletion src/Bootloader/PublishCsrfBootloader.php
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

use Chiron\Core\Container\Bootloader\AbstractBootloader;
use Chiron\Core\Directories;
use Chiron\Core\Publisher;
use Chiron\Publisher\Publisher;

final class PublishCsrfBootloader extends AbstractBootloader
{
Expand Down
29 changes: 3 additions & 26 deletions src/Middleware/CsrfOriginProtectionMiddleware.php
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,7 @@ final class CsrfOriginProtectionMiddleware implements MiddlewareInterface
private $csrfConfig;

/**
* @param HttpConfig $httpConfig
* @param SettingsConfig $settingsConfig
* @param CsrfConfig $csrfConfig
*/
public function __construct(CsrfConfig $csrfConfig)
{
Expand Down Expand Up @@ -148,8 +147,8 @@ private function getTrustedOrigins(ServerRequestInterface $request): array
{
$trustedOrigins = $this->csrfConfig->getTrustedOrigins();

// Method getHost() includes the port.
$host = $this->getHost($request);
// Method getHost() includes the port (if it's non standard).
$host = $request->getUri()->getHost();

// TODO : vérifier l'utilité de ce if $host === '' car je ne sais pas si ce cas peut arriver, et comment ca fonctionne si on ajoute d'officie le host vide dans le tableau comment va se comporter la méthode isSameDomain ????
if ($host !== '') {
Expand All @@ -159,28 +158,6 @@ private function getTrustedOrigins(ServerRequestInterface $request): array
return $trustedOrigins;
}

/**
* Returns the HTTP host + port (if it's non-standard).
*
* @param ServerRequestInterface $request
*
* @return string
*/
private function getHost(ServerRequestInterface $request): string
{
$host = $request->getUri()->getHost();
if ($host === '') {
return '';
}
// Standard ports are null (80, 443)
$port = $request->getUri()->getPort();
if ($port !== null) {
$host .= ':' . $port;
}

return $host;
}

private function isTrustedOrigin(string $origin, array $trustedOrigins): bool
{
// Check if the request's origin matches any of our trusted origins.
Expand Down

0 comments on commit f9cdf8c

Please sign in to comment.