Skip to content

Commit

Permalink
fix conflicts
Browse files Browse the repository at this point in the history
  • Loading branch information
taylorotwell committed Jul 27, 2020
2 parents 668642a + edd64e8 commit 428dc79
Show file tree
Hide file tree
Showing 4 changed files with 38 additions and 4 deletions.
29 changes: 29 additions & 0 deletions src/Illuminate/Cookie/CookieValuePrefix.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
<?php

namespace Illuminate\Cookie;

class CookieValuePrefix
{
/**
* Create a new cookie value prefix for the given cookie name.
*
* @param string $cookieName
* @param string $key
* @return string
*/
public static function create($cookieName, $key)
{
return hash_hmac('sha1', $cookieName.'v2', $key).'|';
}

/**
* Remove the cookie value prefix.
*
* @param string $cookieValue
* @return string
*/
public static function remove($cookieValue)
{
return substr($cookieValue, 41);
}
}
7 changes: 5 additions & 2 deletions src/Illuminate/Cookie/Middleware/EncryptCookies.php
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
use Closure;
use Illuminate\Contracts\Encryption\DecryptException;
use Illuminate\Contracts\Encryption\Encrypter as EncrypterContract;
use Illuminate\Cookie\CookieValuePrefix;
use Symfony\Component\HttpFoundation\Cookie;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
Expand Down Expand Up @@ -82,8 +83,10 @@ protected function decrypt(Request $request)
try {
$value = $this->decryptCookie($key, $cookie);

$hashValidPrefix = strpos($value, CookieValuePrefix::create($key, $this->encrypter->getKey())) === 0;

$request->cookies->set(
$key, strpos($value, hash_hmac('sha1', $key.'v2', $this->encrypter->getKey()).'|') !== 0 ? null : substr($value, 41)
$key, $hasValidPrefix ? CookieValuePrefix::remove($value) : null
);
} catch (DecryptException $e) {
$request->cookies->set($key, null);
Expand Down Expand Up @@ -142,7 +145,7 @@ protected function encrypt(Response $response)
$response->headers->setCookie($this->duplicate(
$cookie,
$this->encrypter->encrypt(
hash_hmac('sha1', $cookie->getName().'v2', $this->encrypter->getKey()).'|'.$cookie->getValue(),
CookieValuePrefix::create($cookie->getName(), $this->encrypter->getKey()).$cookie->getValue(),
static::serialized($cookie->getName())
)
));
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
use Illuminate\Contracts\Encryption\Encrypter;
use Illuminate\Contracts\Foundation\Application;
use Illuminate\Contracts\Support\Responsable;
use Illuminate\Cookie\CookieValuePrefix;
use Illuminate\Cookie\Middleware\EncryptCookies;
use Illuminate\Session\TokenMismatchException;
use Illuminate\Support\InteractsWithTime;
Expand Down Expand Up @@ -151,7 +152,7 @@ protected function getTokenFromRequest($request)
$token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');

if (! $token && $header = $request->header('X-XSRF-TOKEN')) {
$token = substr($this->encrypter->decrypt($header, static::serialized()), 41);
$token = CookieValuePrefix::remove($this->encrypter->decrypt($header, static::serialized()));
}

return $token;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
namespace Illuminate\Foundation\Testing\Concerns;

use Illuminate\Contracts\Http\Kernel as HttpKernel;
use Illuminate\Cookie\CookieValuePrefix;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Illuminate\Testing\TestResponse;
Expand Down Expand Up @@ -600,7 +601,7 @@ protected function prepareCookiesForRequest()
}

return collect($this->defaultCookies)->map(function ($value, $key) {
return encrypt(hash_hmac('sha1', $key.'v2', base64_decode(substr(config('app.key'), 7))).'|'.$value, false);
return encrypt(CookieValuePrefix::create($key, base64_decode(substr(config('app.key'), 7))).$value, false);
})->merge($this->unencryptedCookies)->all();
}

Expand Down

0 comments on commit 428dc79

Please sign in to comment.