diff --git a/packages/realtime-compiler/resources/dashboard.blade.php b/packages/realtime-compiler/resources/dashboard.blade.php index 318e9f70b55..fbbce0bcc8b 100644 --- a/packages/realtime-compiler/resources/dashboard.blade.php +++ b/packages/realtime-compiler/resources/dashboard.blade.php @@ -4,6 +4,7 @@ + {{ $title }} @@ -64,6 +65,7 @@

Site Pages & Routes

@if($dashboard->isInteractive())
+
@@ -136,6 +138,7 @@
+
@@ -242,6 +245,7 @@
@if($dashboard->isInteractive()) + @@ -302,6 +306,7 @@ @if($dashboard->isInteractive())
+ diff --git a/packages/realtime-compiler/src/Http/BaseController.php b/packages/realtime-compiler/src/Http/BaseController.php index 862453922ea..6cc264b6128 100644 --- a/packages/realtime-compiler/src/Http/BaseController.php +++ b/packages/realtime-compiler/src/Http/BaseController.php @@ -4,6 +4,7 @@ namespace Hyde\RealtimeCompiler\Http; +use BadMethodCallException; use Desilva\Microserve\Request; use Desilva\Microserve\Response; use Desilva\Microserve\JsonResponse; @@ -76,6 +77,14 @@ protected function authorizePostRequest(): void if (! $this->isRequestMadeFromLocalhost()) { throw new HttpException(403, "Refusing to serve request from address {$_SERVER['REMOTE_ADDR']} (must be on localhost)"); } + + if ($this->withSession) { + if (! $this->validateCSRFToken($this->request->get('_token'))) { + throw new HttpException(403, 'Invalid CSRF token'); + } else { + $this->expireCSRFToken(); + } + } } protected function isRequestMadeFromLocalhost(): bool @@ -91,6 +100,41 @@ protected function isRequestMadeFromLocalhost(): bool return in_array($requestIp, $allowedIps, true); } + protected function generateCSRFToken(): string + { + if (session_status() !== PHP_SESSION_ACTIVE) { + throw new BadMethodCallException('Session not started'); + } + + if (empty($_SESSION['csrf_token'])) { + $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); + } + + return $_SESSION['csrf_token']; + } + + protected function validateCSRFToken(?string $suppliedToken): bool + { + if (session_status() !== PHP_SESSION_ACTIVE) { + throw new BadMethodCallException('Session not started'); + } + + if ($suppliedToken === null) { + return false; + } + + return ! empty($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $suppliedToken); + } + + protected function expireCSRFToken(): void + { + if (session_status() !== PHP_SESSION_ACTIVE) { + throw new BadMethodCallException('Session not started'); + } + + unset($_SESSION['csrf_token']); + } + protected function writeToConsole(string $message, string $context = 'dashboard'): void { if (isset($this->console)) { diff --git a/packages/realtime-compiler/src/Http/DashboardController.php b/packages/realtime-compiler/src/Http/DashboardController.php index 7c67d54d64a..84fa92ab6b7 100644 --- a/packages/realtime-compiler/src/Http/DashboardController.php +++ b/packages/realtime-compiler/src/Http/DashboardController.php @@ -93,7 +93,7 @@ public function handle(): Response protected function show(): string { return AnonymousViewCompiler::handle(__DIR__.'/../../resources/dashboard.blade.php', array_merge( - (array) $this, ['dashboard' => $this, 'request' => $this->request], + (array) $this, ['dashboard' => $this, 'request' => $this->request, 'csrfToken' => $this->generateCSRFToken()], )); }