blob: 89928f93c01fcbebb1f4a1d2e025de31ef108026 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
<?php
class Request
{
public $URL; // full request url
public $PATH; // Path (decoded)
public $QUERY; // Query string (decoded)
public $HOST;
public $PORT;
public $METHOD; // request method
public $TIME; // request timestamp
public $IP; // Client's IP address
public $AGENT; // Client's User Agent
public $GET = []; // $_GET array
public $POST = []; // $_POST array
public $FILES = []; // $_FILES array
public $SIGNATURE; // user/client's device signature
public function __construct($errors = false)
{
$parsed = parse_url($_SERVER['REQUEST_URI']);
$this->URL = $_SERVER['REQUEST_URI'];
$this->PATH = (!empty($parsed['path'])) ? urldecode($parsed['path']) : '';
$this->QUERY = (!empty($parsed['query'])) ? urldecode($parsed['query']) : false;
$this->HOST = $_SERVER['HTTP_HOST'];
$this->PORT = $_SERVER['SERVER_PORT'];
$this->TIME = $_SERVER['REQUEST_TIME'];
$this->IP = $_SERVER['REMOTE_ADDR'];
$this->METHOD = strtolower($_SERVER['REQUEST_METHOD']);
$this->GET = $_GET; // $_GET should only used
// to request data or specify options (never to perform
// system-changes) thus should not need any validation;
// * If (for any reason) you requide $_GET sanitization
// enable it later on the method's code
$this->FILES = $_FILES; // TODO: sanitize the files array
// $this->INTERFACE = php_sapi_name();
$this->AGENT = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';
$this->SIGNATURE = sha1(
$_SERVER['HTTP_USER_AGENT'] ?? 'unknown'
. $_SERVER['HTTP_ACCEPT'] ?? ''
. $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? ''
. $_SERVER['HTTP_ACCEPT_ENCODING'] ?? ''
);
// sanitize user input
// if (isset($_GET)) { $this->GET = $this->sanitize($_GET); }
$this->GET = $this->sanitize($_GET);
if (isset($_POST)) { $this->POST = $this->sanitize($_POST); }
if (isset($_COOKIE)) { $this->COOKIE = $this->sanitize($_COOKIE); }
// check anti-CSRF token if needed
// (again, GET requests should not need CSRF cheking)
if (in_array($this->METHOD, ['post', 'put', 'patch', 'delete'])) {
// TODO: only if CSRF protection enabled...
$this->checkCsrfToken();
}
}
/**
* Check:
*
* 1.
* https://dev.to/anastasionico/good-practices-how-to-sanitize-validate-and-escape-in-php-3-methods-139b
*
* 2.
* https://benhoyt.com/writings/dont-sanitize-do-escape/
*
*/
private function sanitize($array)
{
// TODO:
// ...
return $array;
}
public function checkCsrfToken()
{
// TODO:
// ...
// if SCRF-token is not valideted, serve 403
return true;
}
public function isAjax(): bool
{
// check headers 'XMLHttpRequest' == $this->headers->get('X-Requested-With');
}
public function isSecure(): bool
{
// chech if HTTPS
}
public function hasSession(): bool
{
// chech if Session exist
}
/**
* Get the user making the request.
*
* @param string|null $guard
* @return mixed
*/
public function user($guard = null)
{
// return call_user_func($this->getUserResolver(), $guard);
}
public function getUserResolver()
{
// return $this->userResolver ?: function () {
//
// };
}
/**
* Set the user resolver callback.
*
* @param \Closure $callback
* @return $this
*/
public function setUserResolver(Closure $callback)
{
// $this->userResolver = $callback;
// return $this;
}
}
|
