blob: 20b82c7150eb774a09dbe6bf174dc0720841d93a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
<?php
class Request
{
public $URL; // full request url
public $PATH; // Path (decoded)
public $QUERY; // Query string (decoded)
public $HOST;
public $PORT;
public $METHOD; // request method
public $TIME; // request timestamp
public $IP; // Client's IP address
public $AGENT; // Client's User Agent
public $GET = [];
public $POST = [];
public $SIGNATURE; // user/client's device signature
public function __construct($errors = false)
{
$parsed = parse_url($_SERVER['REQUEST_URI']);
$this->URL = $_SERVER['REQUEST_URI'];
$this->PATH = (!empty($parsed['path'])) ? urldecode($parsed['path']) : '';
$this->QUERY = (!empty($parsed['query'])) ? urldecode($parsed['query']) : false;
$this->HOST = $_SERVER['HTTP_HOST'];
$this->PORT = $_SERVER['SERVER_PORT'];
$this->TIME = $_SERVER['REQUEST_TIME'];
$this->CLI_IP = $_SERVER['REMOTE_ADDR'];
$this->METHOD = strtolower($_SERVER['REQUEST_METHOD']);
$this->GET = $_GET; // $_GET should only used
// to request data or specify options (never to perform
// system-changes) thus should not need any validation;
// * If (for any reason) you requide $_GET sanitization
// enable it later on the method's code
// $this->INTERFACE = php_sapi_name();
$this->AGENT = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';
$this->SIGNATURE = sha1(
$_SERVER['HTTP_USER_AGENT'] ?? 'unknown'
. $_SERVER['HTTP_ACCEPT'] ?? ''
. $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? ''
. $_SERVER['HTTP_ACCEPT_ENCODING'] ?? ''
);
// sanitize user input
// if (isset($_GET)) { $this->GET = $this->sanitize($_GET); }
$this->GET = $this->sanitize($_GET);
if (isset($_POST)) { $this->POST = $this->sanitize($_POST); }
if (isset($_COOKIE)) { $this->COOKIE = $this->sanitize($_COOKIE); }
// check anti-CSRF token if needed
// (again, GET requests should not need CSRF cheking)
if (in_array($this->METHOD, ['post', 'put', 'patch', 'delete'])) {
// TODO: only if CSRF protection enabled...
$this->checkCsrfToken();
}
}
private function sanitize($array)
{
// TODO:
// ...
return $array;
}
public function checkCsrfToken()
{
// TODO:
// ...
// if SCRF-token is not valideted, serve 403
return $array;
}
}
|
