franzz/livetrail
1
0
Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity

Split authentication & newsletter subscription
Deploy Spot / deploy (push) Successful in 32s
Details

Browse Source
This commit is contained in:
franzz
2026-08-10 16:41:20 +02:00
parent 3e3c3ee821
commit 462502cf9f
19 changed files with 628 additions and 481 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/Controller.php
+10 -5
View File
@@ -12,6 +12,8 @@ class Controller extends PhpObject
'add_post',
'subscribe',
'unsubscribe',
'login',
'logout',
'update_project',
'upload',
'add_comment',
@@ -55,11 +57,15 @@ class Controller extends PhpObject
$this->setReqVal('value', $asReq['value'] ?? '');
$this->setReqVal('type', $asReq['type'] ?? '');
$this->setReqVal('email', $asReq['email'] ?? '');
$this->setReqVal('password', $asReq['password'] ?? '');
$this->setReqVal('latitude', $asReq['latitude'] ?? '');
$this->setReqVal('longitude', $asReq['longitude'] ?? '');
$this->setReqVal('timestamp', $asReq['timestamp'] ?? 0, 'positiveInt');
$this->setReqVal('csrf_token', $_SERVER['HTTP_X_CSRF_TOKEN'] ?? ($_POST['csrf_token'] ?? ''));
//Authentication and CSRF protection share the same server-side session.
$this->initCsrfToken();
//Create Spot Instance
$this->oSpot = new Spot($sProcessPage, $this->asReq['t']);
$this->oSpot->setProjectId($this->asReq['id_project']);
@@ -72,6 +78,7 @@ class Controller extends PhpObject
//Clean errors
$sDebug = ob_get_clean();
if($sDebug != '') $this->oSpot->addUncaughtError($sDebug);
if(session_status() === PHP_SESSION_ACTIVE) session_write_close();
return $sResult;
}
@@ -103,16 +110,13 @@ class Controller extends PhpObject
{
if(PHP_SAPI === 'cli') return;
$bCloseSession = false;
if(session_status() !== PHP_SESSION_ACTIVE) {
$bSecure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https');
session_set_cookie_params(array('httponly' => true, 'secure' => $bSecure, 'samesite' => 'Lax'));
session_start();
$bCloseSession = true;
}
$this->setCsrfToken();
if($bCloseSession) session_write_close();
}
private function checkCsrfToken(string $sClientToken): bool
@@ -130,9 +134,10 @@ class Controller extends PhpObject
'next_feed' => $this->oSpot->getNextFeed($this->asReq['id']),
'new_feed' => $this->oSpot->getNewFeed($this->asReq['id']),
'add_post' => $this->oSpot->addPost($this->asReq['name'], $this->asReq['content']),
'subscribe' => $this->oSpot->subscribe($this->asReq['email'], $this->asReq['name']),
'subscribe' => $this->oSpot->subscribe(),
'unsubscribe' => $this->oSpot->unsubscribe(),
'unsubscribe_email' => $this->oSpot->unsubscribeFromEmail($this->asReq['id_entity']),
'login' => $this->oSpot->login($this->asReq['email'], $this->asReq['password'], $this->asReq['name']),
'logout' => $this->oSpot->logout(),
'update_project' => $this->oSpot->updateProject(),
default => $this->dispatchAdmin($sAction)
};