Skip to content

Commit 97d4a5f

Browse files
carlbennettcarlbennett
committed
Remove CSRF class and check behavior
* CSRF is Cross-Site Request Forgery. * The class was mislabeled CSRF instead of AntiCSRF when it was created. * Anti-CSRF features worked well but was seen as unnecessary. * Since Memcache is being ripped out which this depends on, this is going with.
1 parent 2302413 commit 97d4a5f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+12
-402
lines changed

‎src/controllers/Comment/Delete.php‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Comment;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\Comment;
87
use \BNETDocs\Libraries\EventTypes;
98
use \BNETDocs\Libraries\Exceptions\CommentNotFoundException;
@@ -24,8 +23,6 @@ public function &run(Router &$router, View &$view, array &$args) {
2423
$data = $router->getRequestQueryArray();
2524
$model = new CommentDeleteModel();
2625
$model->comment = null;
27-
$model->csrf_id = mt_rand();
28-
$model->csrf_token = CSRF::generate($model->csrf_id);
2926
$model->error = null;
3027
$model->id = (isset($data['id']) ? $data['id'] : null);
3128
$model->parent_id = null;
@@ -68,19 +65,7 @@ protected function tryDelete(Router &$router, CommentDeleteModel &$model) {
6865
return;
6966
}
7067

71-
$data = $router->getRequestBodyArray();
72-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
73-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
74-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
75-
76-
if (!$csrf_valid) {
77-
$model->error = 'INVALID_CSRF';
78-
return;
79-
}
80-
CSRF::invalidate($csrf_id);
81-
8268
$model->error = false;
83-
8469
$id = (int) $model->id;
8570
$parent_type = (int) $model->parent_type;
8671
$parent_id = (int) $model->parent_id;

‎src/controllers/Comment/Edit.php‎

Lines changed: 2 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Comment;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\Comment;
87
use \BNETDocs\Libraries\EventTypes;
98
use \BNETDocs\Libraries\Exceptions\CommentNotFoundException;
@@ -30,14 +29,8 @@ public function &run( Router &$router, View &$view, array &$args ) {
3029
$post_data = $router->getRequestBodyArray();
3130

3231
$model = new CommentEditModel();
33-
34-
$model->csrf_id = mt_rand();
35-
$model->csrf_token = CSRF::generate( $model->csrf_id );
36-
$model->user = Authentication::$user;
37-
38-
$model->id = (
39-
isset( $query_data[ 'id' ]) ? $query_data[ 'id' ] : null
40-
);
32+
$model->user = Authentication::$user;
33+
$model->id = (isset( $query_data[ 'id' ]) ? $query_data[ 'id' ] : null);
4134
$model->content = (
4235
isset( $post_data[ 'content' ]) ? $post_data[ 'content' ] : null
4336
);
@@ -100,23 +93,6 @@ protected function tryModify( Router &$router, CommentEditModel &$model ) {
10093
return;
10194
}
10295

103-
$post_data = $router->getRequestBodyArray();
104-
105-
$csrf_id = (
106-
isset( $post_data[ 'csrf_id' ]) ? $post_data[ 'csrf_id' ] : null
107-
);
108-
$csrf_token = (
109-
isset( $post_data[ 'csrf_token' ]) ? $post_data[ 'csrf_token' ] : null
110-
);
111-
$csrf_valid = CSRF::validate( $csrf_id, $csrf_token );
112-
113-
if ( !$csrf_valid ) {
114-
$model->error = 'INVALID_CSRF';
115-
return;
116-
}
117-
118-
CSRF::invalidate( $csrf_id );
119-
12096
$model->error = false;
12197

12298
$id = (int) $model->id;

‎src/controllers/Document/Create.php‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Document;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\Document;
87
use \BNETDocs\Libraries\EventTypes;
98
use \BNETDocs\Libraries\Logger;
@@ -19,8 +18,6 @@
1918
class Create extends Controller {
2019
public function &run(Router &$router, View &$view, array &$args) {
2120
$model = new DocumentCreateModel();
22-
$model->csrf_id = mt_rand();
23-
$model->csrf_token = CSRF::generate($model->csrf_id, 7200); // 2 hours
2421
$model->error = null;
2522
$model->user = Authentication::$user;
2623

@@ -48,9 +45,6 @@ protected function handlePost(Router &$router, DocumentCreateModel &$model) {
4845
Common::$database = DatabaseDriver::getDatabaseObject();
4946
}
5047
$data = $router->getRequestBodyArray();
51-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
52-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
53-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
5448
$title = (isset($data['title' ]) ? $data['title' ] : null);
5549
$markdown = (isset($data['markdown' ]) ? $data['markdown' ] : null);
5650
$content = (isset($data['content' ]) ? $data['content' ] : null);
@@ -61,12 +55,6 @@ protected function handlePost(Router &$router, DocumentCreateModel &$model) {
6155
$model->markdown = $markdown;
6256
$model->content = $content;
6357

64-
if (!$csrf_valid) {
65-
$model->error = 'INVALID_CSRF';
66-
return;
67-
}
68-
CSRF::invalidate($csrf_id);
69-
7058
if (empty($title)) {
7159
$model->error = 'EMPTY_TITLE';
7260
} else if (empty($content)) {

‎src/controllers/Document/Delete.php‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Document;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\Document;
87
use \BNETDocs\Libraries\EventTypes;
98
use \BNETDocs\Libraries\Exceptions\DocumentNotFoundException;
@@ -22,8 +21,6 @@ class Delete extends Controller {
2221
public function &run(Router &$router, View &$view, array &$args) {
2322
$data = $router->getRequestQueryArray();
2423
$model = new DocumentDeleteModel();
25-
$model->csrf_id = mt_rand();
26-
$model->csrf_token = CSRF::generate($model->csrf_id);
2724
$model->document = null;
2825
$model->error = null;
2926
$model->id = (isset($data['id']) ? $data['id'] : null);
@@ -59,17 +56,6 @@ protected function tryDelete(Router &$router, DocumentDeleteModel &$model) {
5956
return;
6057
}
6158

62-
$data = $router->getRequestBodyArray();
63-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
64-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
65-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
66-
67-
if (!$csrf_valid) {
68-
$model->error = 'INVALID_CSRF';
69-
return;
70-
}
71-
CSRF::invalidate($csrf_id);
72-
7359
if (!$model->acl_allowed) {
7460
$model->error = 'ACL_NOT_SET';
7561
return;

‎src/controllers/Document/Edit.php‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Document;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\Document;
87
use \BNETDocs\Libraries\EventTypes;
98
use \BNETDocs\Libraries\Exceptions\DocumentNotFoundException;
@@ -26,8 +25,6 @@ public function &run(Router &$router, View &$view, array &$args) {
2625
$data = $router->getRequestQueryArray();
2726
$model = new DocumentEditModel();
2827
$model->content = null;
29-
$model->csrf_id = mt_rand();
30-
$model->csrf_token = CSRF::generate($model->csrf_id, 7200); // 2 hours
3128
$model->document = null;
3229
$model->document_id = (isset($data['id']) ? $data['id'] : null);
3330
$model->error = null;
@@ -74,9 +71,6 @@ protected function handlePost(Router &$router, DocumentEditModel &$model) {
7471
}
7572

7673
$data = $router->getRequestBodyArray();
77-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
78-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
79-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
8074
$category = (isset($data['category' ]) ? $data['category' ] : null);
8175
$title = (isset($data['title' ]) ? $data['title' ] : null);
8276
$markdown = (isset($data['markdown' ]) ? $data['markdown' ] : null);
@@ -89,12 +83,6 @@ protected function handlePost(Router &$router, DocumentEditModel &$model) {
8983
$model->markdown = $markdown;
9084
$model->content = $content;
9185

92-
if (!$csrf_valid) {
93-
$model->error = 'INVALID_CSRF';
94-
return;
95-
}
96-
CSRF::invalidate($csrf_id);
97-
9886
if (empty($title)) {
9987
$model->error = 'EMPTY_TITLE';
10088
} else if (empty($content)) {

‎src/controllers/News/Create.php‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\News;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\EventTypes;
87
use \BNETDocs\Libraries\Exceptions\UnspecifiedViewException;
98
use \BNETDocs\Libraries\Logger;
@@ -21,8 +20,6 @@
2120
class Create extends Controller {
2221
public function &run(Router &$router, View &$view, array &$args) {
2322
$model = new NewsCreateModel();
24-
$model->csrf_id = mt_rand();
25-
$model->csrf_token = CSRF::generate($model->csrf_id, 7200); // 2 hours
2623
$model->error = null;
2724
$model->news_categories = null;
2825
$model->user = Authentication::$user;
@@ -60,9 +57,6 @@ protected function handlePost(Router &$router, NewsCreateModel &$model) {
6057
Common::$database = DatabaseDriver::getDatabaseObject();
6158
}
6259
$data = $router->getRequestBodyArray();
63-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
64-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
65-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
6660
$category = (isset($data['category' ]) ? $data['category' ] : null);
6761
$title = (isset($data['title' ]) ? $data['title' ] : null);
6862
$markdown = (isset($data['markdown' ]) ? $data['markdown' ] : null);
@@ -77,12 +71,6 @@ protected function handlePost(Router &$router, NewsCreateModel &$model) {
7771
$model->content = $content;
7872
$model->rss_exempt = $rss_exempt;
7973

80-
if (!$csrf_valid) {
81-
$model->error = 'INVALID_CSRF';
82-
return;
83-
}
84-
CSRF::invalidate($csrf_id);
85-
8674
if (empty($title)) {
8775
$model->error = 'EMPTY_TITLE';
8876
} else if (empty($content)) {

‎src/controllers/News/Delete.php‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\News;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\EventTypes;
87
use \BNETDocs\Libraries\Exceptions\NewsPostNotFoundException;
98
use \BNETDocs\Libraries\Logger;
@@ -22,8 +21,6 @@ class Delete extends Controller {
2221
public function &run(Router &$router, View &$view, array &$args) {
2322
$data = $router->getRequestQueryArray();
2423
$model = new NewsDeleteModel();
25-
$model->csrf_id = mt_rand();
26-
$model->csrf_token = CSRF::generate($model->csrf_id);
2724
$model->error = null;
2825
$model->id = (isset($data['id']) ? $data['id'] : null);
2926
$model->news_post = null;
@@ -59,17 +56,6 @@ protected function tryDelete(Router &$router, NewsDeleteModel &$model) {
5956
return;
6057
}
6158

62-
$data = $router->getRequestBodyArray();
63-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
64-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
65-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
66-
67-
if (!$csrf_valid) {
68-
$model->error = 'INVALID_CSRF';
69-
return;
70-
}
71-
CSRF::invalidate($csrf_id);
72-
7359
if (!$model->acl_allowed) {
7460
$model->error = 'ACL_NOT_SET';
7561
return;

‎src/controllers/News/Edit.php‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\News;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\EventTypes;
87
use \BNETDocs\Libraries\Exceptions\NewsPostNotFoundException;
98
use \BNETDocs\Libraries\Logger;
@@ -28,8 +27,6 @@ public function &run(Router &$router, View &$view, array &$args) {
2827
$model = new NewsEditModel();
2928
$model->category = null;
3029
$model->content = null;
31-
$model->csrf_id = mt_rand();
32-
$model->csrf_token = CSRF::generate($model->csrf_id, 7200); // 2 hours
3330
$model->error = null;
3431
$model->markdown = null;
3532
$model->news_categories = null;
@@ -88,9 +85,6 @@ protected function handlePost(Router &$router, NewsEditModel &$model) {
8885
}
8986

9087
$data = $router->getRequestBodyArray();
91-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
92-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
93-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
9488
$category = (isset($data['category' ]) ? $data['category' ] : null);
9589
$title = (isset($data['title' ]) ? $data['title' ] : null);
9690
$markdown = (isset($data['markdown' ]) ? $data['markdown' ] : null);
@@ -105,12 +99,6 @@ protected function handlePost(Router &$router, NewsEditModel &$model) {
10599
$model->content = $content;
106100
$model->rss_exempt = $rss_exempt;
107101

108-
if (!$csrf_valid) {
109-
$model->error = 'INVALID_CSRF';
110-
return;
111-
}
112-
CSRF::invalidate($csrf_id);
113-
114102
if (empty($title)) {
115103
$model->error = 'EMPTY_TITLE';
116104
} else if (empty($content)) {

‎src/controllers/Packet/Delete.php‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Packet;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\Packet;
87
use \BNETDocs\Libraries\EventTypes;
98
use \BNETDocs\Libraries\Exceptions\PacketNotFoundException;
@@ -22,8 +21,6 @@ class Delete extends Controller {
2221
public function &run(Router &$router, View &$view, array &$args) {
2322
$data = $router->getRequestQueryArray();
2423
$model = new PacketDeleteModel();
25-
$model->csrf_id = mt_rand();
26-
$model->csrf_token = CSRF::generate($model->csrf_id);
2724
$model->error = null;
2825
$model->id = (isset($data['id']) ? $data['id'] : null);
2926
$model->packet = null;
@@ -60,17 +57,6 @@ protected function tryDelete(Router &$router, PacketDeleteModel &$model) {
6057
return;
6158
}
6259

63-
$data = $router->getRequestBodyArray();
64-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
65-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
66-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
67-
68-
if (!$csrf_valid) {
69-
$model->error = 'INVALID_CSRF';
70-
return;
71-
}
72-
CSRF::invalidate($csrf_id);
73-
7460
if (!$model->acl_allowed) {
7561
$model->error = 'ACL_NOT_SET';
7662
return;

‎src/controllers/Packet/Edit.php‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace BNETDocs\Controllers\Packet;
44

55
use \BNETDocs\Libraries\Authentication;
6-
use \BNETDocs\Libraries\CSRF;
76
use \BNETDocs\Libraries\EventTypes;
87
use \BNETDocs\Libraries\Exceptions\PacketNotFoundException;
98
use \BNETDocs\Libraries\Logger;
@@ -26,8 +25,6 @@ class Edit extends Controller {
2625
public function &run(Router &$router, View &$view, array &$args) {
2726
$data = $router->getRequestQueryArray();
2827
$model = new PacketEditModel();
29-
$model->csrf_id = mt_rand();
30-
$model->csrf_token = CSRF::generate($model->csrf_id, 7200); // 2 hours
3128
$model->deprecated = null;
3229
$model->error = null;
3330
$model->format = null;
@@ -84,9 +81,6 @@ protected function handlePost(Router &$router, PacketEditModel &$model) {
8481
}
8582

8683
$data = $router->getRequestBodyArray();
87-
$csrf_id = (isset($data['csrf_id' ]) ? $data['csrf_id' ] : null);
88-
$csrf_token = (isset($data['csrf_token']) ? $data['csrf_token'] : null);
89-
$csrf_valid = CSRF::validate($csrf_id, $csrf_token);
9084
$id = (isset($data['id' ]) ? $data['id' ] : null);
9185
$name = (isset($data['name' ]) ? $data['name' ] : null);
9286
$format = (isset($data['format' ]) ? $data['format' ] : null);
@@ -108,12 +102,6 @@ protected function handlePost(Router &$router, PacketEditModel &$model) {
108102
$model->research = $research;
109103
$model->published = $published;
110104

111-
if (!$csrf_valid) {
112-
$model->error = 'INVALID_CSRF';
113-
return;
114-
}
115-
CSRF::invalidate($csrf_id);
116-
117105
if (empty($name)) {
118106
$model->error = 'EMPTY_NAME';
119107
} else if (empty($format)) {

0 commit comments

Comments
 (0)