Completed
Push — master ( 579af5...b29473 )
by Oleg
07:53
created

CsrfFilter::pre()   C

Complexity

Conditions 8
Paths 10

Size

Total Lines 34
Code Lines 18

Duplication

Lines 8
Ratio 23.53 %

Importance

Changes 1
Bugs 1 Features 0
Metric Value
dl 8
loc 34
rs 5.3846
c 1
b 1
f 0
cc 8
eloc 18
nc 10
nop 1
1
<?php /** CsrfFilterMicro */
2
3
namespace Micro\Filter;
4
5
/**
6
 * Class CsrfFilter
7
 *
8
 * @author Oleg Lunegov <[email protected]>
9
 * @link https://github.com/lugnsk/micro
10
 * @copyright Copyright &copy; 2013 Oleg Lunegov
11
 * @license /LICENSE
12
 * @package Micro
13
 * @subpackage Filter
14
 * @version 1.0
15
 * @since 1.0
16
 */
17
class CsrfFilter extends Filter
18
{
19
    /**
20
     * @inheritdoc
21
     */
22
    public function pre(array $params)
23
    {
24
        if ($this->container->request->server('REQUEST_METHOD') !== 'POST') {
0 ignored issues
show
Bug introduced by
Accessing request on the interface Micro\Base\IContainer suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
25
            return true;
26
        }
27
28
        $postCSRF = $this->container->request->post('csrf');
0 ignored issues
show
Bug introduced by
Accessing request on the interface Micro\Base\IContainer suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
29
30 View Code Duplication
        if (!$postCSRF) {
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
31
            $this->result = [
32
                'redirect' => !empty($rule['redirect']) ? $rule['redirect'] : null,
0 ignored issues
show
Bug introduced by
The variable $rule seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

This check looks for calls to isset(...) or empty() on variables that are yet undefined. These calls will always produce the same result and can be removed.

This is most likely caused by the renaming of a variable or the removal of a function/method parameter.

Loading history...
33
                'message' => !empty($rule['message']) ? $rule['message'] : 'Not allowed!'
34
            ];
35
36
            return false;
37
        }
38
39
        $csrf = $this->container->session->csrf;
0 ignored issues
show
Bug introduced by
Accessing session on the interface Micro\Base\IContainer suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
40
41
        if (($key = in_array(md5($postCSRF), $csrf, true)) !== null) {
42
            unset($csrf[$key]);
43
44
            $this->container->session->csrf = $csrf;
0 ignored issues
show
Bug introduced by
Accessing session on the interface Micro\Base\IContainer suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
45
46
            return true;
47
        }
48
49
        $this->result = [
50
            'redirect' => !empty($rule['redirect']) ? $rule['redirect'] : null,
51
            'message' => !empty($rule['message']) ? $rule['message'] : 'Bad request!'
52
        ];
53
54
        return false;
55
    }
56
57
    /**
58
     * @inheritdoc
59
     */
60
    public function post(array $params)
61
    {
62
        return preg_replace_callback(
63
            '/(<form[^>]*>)(.*?)(<\/form>)/m',
64
            array($this, 'insertProtect'),
65
            $params['data']
66
        );
67
    }
68
69
    /**
70
     * Insert CSRF protect into forms
71
     *
72
     * @access public
73
     *
74
     * @param array $matches Form
75
     *
76
     * @return string
77
     */
78
    public function insertProtect(array $matches = [])
79
    {
80
        $gen = md5(mt_rand());
81
        $s   = $this->container->session;
0 ignored issues
show
Bug introduced by
Accessing session on the interface Micro\Base\IContainer suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
82
83
        $s->csrf = array_merge(is_array($s->csrf) ? $s->csrf : [], [md5($gen)]);
84
85
        return $matches[1] . '<input type="hidden" name="csrf" value="' . $gen . '" />' . $matches[2] . $matches[3];
86
    }
87
}
88