41 lines
1.1 KiB
PHP
41 lines
1.1 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Protezione CSRF minima per i form POST e le chiamate fetch.
|
|
*
|
|
* Uso nei form: <?php echo yb_csrf_field(); ?>
|
|
* Uso in fetch: header 'X-CSRF-TOKEN': '<?php echo e(yb_csrf_token()); ?>'
|
|
* Uso nei salvataggi: yb_csrf_check(); (blocca con 403)
|
|
* if (!yb_csrf_valid()) (per gli endpoint JSON)
|
|
*/
|
|
|
|
function yb_csrf_token(): string
|
|
{
|
|
if (session_status() !== PHP_SESSION_ACTIVE) {
|
|
session_start();
|
|
}
|
|
if (empty($_SESSION['_csrf'])) {
|
|
$_SESSION['_csrf'] = bin2hex(random_bytes(32));
|
|
}
|
|
return $_SESSION['_csrf'];
|
|
}
|
|
|
|
function yb_csrf_field(): string
|
|
{
|
|
return '<input type="hidden" name="_csrf" value="' . htmlspecialchars(yb_csrf_token(), ENT_QUOTES, 'UTF-8') . '">';
|
|
}
|
|
|
|
function yb_csrf_valid(): bool
|
|
{
|
|
$sent = $_POST['_csrf'] ?? ($_SERVER['HTTP_X_CSRF_TOKEN'] ?? '');
|
|
return is_string($sent) && $sent !== '' && hash_equals(yb_csrf_token(), $sent);
|
|
}
|
|
|
|
function yb_csrf_check(): void
|
|
{
|
|
if (!yb_csrf_valid()) {
|
|
http_response_code(403);
|
|
exit('Sessione scaduta: ricarica la pagina e riprova.');
|
|
}
|
|
}
|