| 1 |
<?php |
| 2 |
namespace Depicter\Middleware; |
| 3 |
|
| 4 |
use Averta\WordPress\Utility\Sanitize; |
| 5 |
use Closure; |
| 6 |
use Psr\Http\Message\ResponseInterface; |
| 7 |
use WPEmerge\Csrf\Csrf; |
| 8 |
use WPEmerge\Csrf\CsrfMiddleware as WPEmergeCsrfMiddleware; |
| 9 |
use WPEmerge\Requests\RequestInterface; |
| 10 |
use WPEmerge\Responses\ResponseService; |
| 11 |
|
| 12 |
class CsrfAPIMiddleware extends WPEmergeCsrfMiddleware |
| 13 |
{ |
| 14 |
/** |
| 15 |
* CSRF service. |
| 16 |
* |
| 17 |
* @var Csrf |
| 18 |
*/ |
| 19 |
protected $csrf = null; |
| 20 |
|
| 21 |
/** |
| 22 |
* Response service. |
| 23 |
* |
| 24 |
* @var ResponseService |
| 25 |
*/ |
| 26 |
protected $responseService = null; |
| 27 |
|
| 28 |
/** |
| 29 |
* Constructor. |
| 30 |
* |
| 31 |
* @codeCoverageIgnore |
| 32 |
* |
| 33 |
* @param ResponseService $responseService |
| 34 |
* @param Csrf $csrf |
| 35 |
*/ |
| 36 |
public function __construct( ResponseService $responseService, Csrf $csrf ) { |
| 37 |
$this->responseService = $responseService; |
| 38 |
$this->csrf = $csrf; |
| 39 |
} |
| 40 |
|
| 41 |
/** |
| 42 |
* Reject requests that fail nonce validation. |
| 43 |
* |
| 44 |
* @param RequestInterface $request |
| 45 |
* @param Closure $next |
| 46 |
* @param mixed $action |
| 47 |
* @param bool $byLoggedInUser Whether to check if request is by logged-in user or not |
| 48 |
* |
| 49 |
* @return ResponseInterface |
| 50 |
*/ |
| 51 |
public function handle( RequestInterface $request, Closure $next, $action = -1, bool $byLoggedInUser = true ) { |
| 52 |
|
| 53 |
$isValidToken = false; |
| 54 |
|
| 55 |
// Get token form request |
| 56 |
if( ! $token = $this->csrf->getTokenFromRequest( $request ) ){ |
| 57 |
$token = Sanitize::key( $request->getHeaderLine( 'X-DEPICTER-CSRF' ) ); |
| 58 |
} |
| 59 |
|
| 60 |
// use WordPress Auth Key for CSRF authentication on depicter debug mode |
| 61 |
if( defined( 'DEPICTER_DEBUG' ) && DEPICTER_DEBUG && |
| 62 |
defined( 'AUTH_KEY' ) && ( AUTH_KEY === $token ) |
| 63 |
){ |
| 64 |
$isValidToken = true; |
| 65 |
|
| 66 |
} else { |
| 67 |
// Check if it's a logged-in user |
| 68 |
if( $byLoggedInUser && ! is_user_logged_in() ){ |
| 69 |
return $this->responseService->json([ |
| 70 |
'errors' => 'Not an authorized user.' |
| 71 |
])->withStatus(401); |
| 72 |
} |
| 73 |
|
| 74 |
$actions = explode('|', $action ); |
| 75 |
// Authenticate request token |
| 76 |
foreach( $actions as $csrfAction ){ |
| 77 |
$isValidToken = $isValidToken || $this->csrf->isValidToken( $token, $csrfAction ); |
| 78 |
} |
| 79 |
} |
| 80 |
|
| 81 |
// Terminate cycle on authentication failure |
| 82 |
if ( ! $isValidToken ) { |
| 83 |
return $this->responseService->json([ |
| 84 |
'errors' => ['Session expired, please login again.'] |
| 85 |
])->withStatus(401); |
| 86 |
} |
| 87 |
|
| 88 |
return $next( $request ); |
| 89 |
} |
| 90 |
} |
| 91 |
|
