1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace SilverStripe\Control\Middleware\ConfirmationMiddleware; |
4
|
|
|
|
5
|
|
|
use SilverStripe\Control\HTTPRequest; |
6
|
|
|
use SilverStripe\Security\Confirmation; |
7
|
|
|
|
8
|
|
|
/** |
9
|
|
|
* A rule to match a GET parameter within HTTPRequest |
10
|
|
|
*/ |
11
|
|
|
class GetParameter implements Rule, Bypass |
12
|
|
|
{ |
13
|
|
|
/** |
14
|
|
|
* Parameter name |
15
|
|
|
* |
16
|
|
|
* @var string |
17
|
|
|
*/ |
18
|
|
|
private $name; |
19
|
|
|
|
20
|
|
|
/** |
21
|
|
|
* Initialize the rule with a parameter name |
22
|
|
|
* |
23
|
|
|
* @param string $name |
24
|
|
|
*/ |
25
|
|
|
public function __construct($name) |
26
|
|
|
{ |
27
|
|
|
$this->setName($name); |
28
|
|
|
} |
29
|
|
|
|
30
|
|
|
/** |
31
|
|
|
* Return the parameter name |
32
|
|
|
* |
33
|
|
|
* @return string |
34
|
|
|
*/ |
35
|
|
|
public function getName() |
36
|
|
|
{ |
37
|
|
|
return $this->name; |
38
|
|
|
} |
39
|
|
|
|
40
|
|
|
/** |
41
|
|
|
* Set the parameter name |
42
|
|
|
* |
43
|
|
|
* @param string $name |
44
|
|
|
* |
45
|
|
|
* @return $this |
46
|
|
|
*/ |
47
|
|
|
public function setName($name) |
48
|
|
|
{ |
49
|
|
|
$this->name = $name; |
50
|
|
|
return $this; |
51
|
|
|
} |
52
|
|
|
|
53
|
|
|
/** |
54
|
|
|
* Generates the confirmation item |
55
|
|
|
* |
56
|
|
|
* @param string $token |
57
|
|
|
* |
58
|
|
|
* @return Confirmation\Item |
59
|
|
|
*/ |
60
|
|
|
protected function buildConfirmationItem($token, $value) |
61
|
|
|
{ |
62
|
|
|
return new Confirmation\Item( |
63
|
|
|
$token, |
64
|
|
|
_t(__CLASS__.'.CONFIRMATION_NAME', '"{key}" GET parameter', ['key' => $this->name]), |
65
|
|
|
sprintf('%s = "%s"', $this->name, $value) |
66
|
|
|
); |
67
|
|
|
} |
68
|
|
|
|
69
|
|
|
/** |
70
|
|
|
* Generates the unique token depending on the path and the parameter |
71
|
|
|
* |
72
|
|
|
* @param string $path URL path |
73
|
|
|
* @param string $param The parameter value |
74
|
|
|
* |
75
|
|
|
* @return string |
76
|
|
|
*/ |
77
|
|
|
protected function generateToken($path, $value) |
78
|
|
|
{ |
79
|
|
|
return sprintf('%s::%s?%s=%s', static::class, $path, $this->name, $value); |
80
|
|
|
} |
81
|
|
|
|
82
|
|
|
/** |
83
|
|
|
* Check request contains the GET parameter |
84
|
|
|
* |
85
|
|
|
* @param HTTPRequest $request |
86
|
|
|
* |
87
|
|
|
* @return bool |
88
|
|
|
*/ |
89
|
|
|
protected function checkRequestHasParameter(HTTPRequest $request) |
90
|
|
|
{ |
91
|
|
|
return array_key_exists($this->name, $request->getVars()); |
92
|
|
|
} |
93
|
|
|
|
94
|
|
|
public function checkRequestForBypass(HTTPRequest $request) |
95
|
|
|
{ |
96
|
|
|
return $this->checkRequestHasParameter($request); |
97
|
|
|
} |
98
|
|
|
|
99
|
|
|
public function getRequestConfirmationItem(HTTPRequest $request) |
100
|
|
|
{ |
101
|
|
|
if (!$this->checkRequestHasParameter($request)) { |
102
|
|
|
return null; |
103
|
|
|
} |
104
|
|
|
|
105
|
|
|
$path = $request->getURL(); |
106
|
|
|
$value = $request->getVar($this->name); |
107
|
|
|
|
108
|
|
|
$token = $this->generateToken($path, $value); |
109
|
|
|
|
110
|
|
|
return $this->buildConfirmationItem($token, $value); |
111
|
|
|
} |
112
|
|
|
} |
113
|
|
|
|