|
10 | 10 | if (!defined('__CSRF_PROTECTOR__')) { |
11 | 11 | define('__CSRF_PROTECTOR__', true); // to avoid multiple declaration errors |
12 | 12 |
|
13 | | - // name of HTTP POST variable for authentication |
| 13 | + // Name of HTTP POST variable for authentication |
14 | 14 | define("CSRFP_TOKEN","CSRFP-Token"); |
15 | 15 |
|
16 | 16 | // We insert token name and list of url patterns for which |
|
19 | 19 | define("CSRFP_FIELD_TOKEN_NAME", "csrfp_hidden_data_token"); |
20 | 20 | define("CSRFP_FIELD_URLS", "csrfp_hidden_data_urls"); |
21 | 21 |
|
22 | | - /** |
23 | | - * child exception classes |
24 | | - */ |
| 22 | + /** Indicates configuration file was not found. */ |
25 | 23 | class configFileNotFoundException extends \exception {}; |
26 | | - class jsFileNotFoundException extends \exception {}; |
27 | | - class baseJSFileNotFoundExceptio extends \exception {}; |
| 24 | + |
| 25 | + /** Indicates that configuration file is incomplete. */ |
28 | 26 | class incompleteConfigurationException extends \exception {}; |
| 27 | + |
| 28 | + /** Indicates that CSRF Protector is already initialized. */ |
29 | 29 | class alreadyInitializedException extends \exception {}; |
30 | 30 |
|
31 | 31 | class csrfProtector |
@@ -76,30 +76,38 @@ class csrfProtector |
76 | 76 | * Variable: $config |
77 | 77 | * config file for CSRFProtector |
78 | 78 | * @var int Array, length = 6 |
79 | | - * Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails |
80 | | - * Property: #2: logDirectory (string) => directory in which log will be saved |
81 | | - * Property: #3: customErrorMessage (string) => custom error message to be sent in case |
82 | | - * of failed authentication |
83 | | - * Property: #4: jsFile (string) => location of the CSRFProtector js file |
84 | | - * Property: #5: tokenLength (int) => default length of hash |
85 | | - * Property: #6: disabledJavascriptMessage (string) => error message if client's js is disabled |
| 79 | + * Property: #1: failedAuthAction (int) => action to be taken in case |
| 80 | + * autherisation fails. |
| 81 | + * Property: #3: customErrorMessage (string) => custom error message to |
| 82 | + * be sent in case of failed authentication. |
| 83 | + * Property: #4: jsFile (string) => location of the CSRFProtector js |
| 84 | + * file. |
| 85 | + * Property: #5: tokenLength (int) => default length of hash. |
| 86 | + * Property: #6: disabledJavascriptMessage (string) => error message if |
| 87 | + * client's js is disabled. |
| 88 | + * |
| 89 | + * TODO(mebjas): this field should be private |
86 | 90 | */ |
87 | 91 | public static $config = array(); |
88 | 92 |
|
89 | 93 | /* |
90 | 94 | * Variable: $requiredConfigurations |
91 | 95 | * Contains list of those parameters that are required to be there |
92 | 96 | * in config file for csrfp to work |
| 97 | + * |
| 98 | + * TODO(mebjas): this field should be private |
93 | 99 | */ |
94 | | - public static $requiredConfigurations = array('logDirectory', 'failedAuthAction', 'jsUrl', 'tokenLength'); |
| 100 | + public static $requiredConfigurations = array( |
| 101 | + 'failedAuthAction', 'jsUrl', 'tokenLength'); |
95 | 102 |
|
96 | 103 | /* |
97 | 104 | * Function: function to initialise the csrfProtector work flow |
98 | 105 | * |
99 | 106 | * Parameters: |
100 | | - * $length - length of CSRF_AUTH_TOKEN to be generated |
101 | | - * $action - int array, for different actions to be taken in case of failed validation |
102 | | - * $logger - custom logger class object |
| 107 | + * $length - (int) length of CSRF_AUTH_TOKEN to be generated. |
| 108 | + * $action - (int array), for different actions to be taken in case of |
| 109 | + * failed validation. |
| 110 | + * $logger - (LoggerInterface) custom logger class object. |
103 | 111 | * |
104 | 112 | * Returns: |
105 | 113 | * void |
@@ -179,11 +187,11 @@ public static function init($length = null, $action = null, $logger = null) |
179 | 187 | implode(', ', $missingConfiguration) . ' value(s)'); |
180 | 188 | } |
181 | 189 |
|
182 | | - // Iniialize the logger class |
| 190 | + // Initialize the logger class |
183 | 191 | if ($logger !== null) { |
184 | 192 | self::$logger = $logger; |
185 | 193 | } else { |
186 | | - self::$logger = new csrfpDefaultLogger(self::$config['logDirectory']); |
| 194 | + self::$logger = new csrfpDefaultLogger(); |
187 | 195 | } |
188 | 196 |
|
189 | 197 | // Authorise the incoming request |
@@ -212,9 +220,8 @@ public static function init($length = null, $action = null, $logger = null) |
212 | 220 | * |
213 | 221 | * Returns: |
214 | 222 | * void |
215 | | - * |
216 | | - * Throws: |
217 | | - * logDirectoryNotFoundException - if log directory is not found |
| 223 | + * |
| 224 | + * TODO(mebjas): this method should be private. |
218 | 225 | */ |
219 | 226 | public static function authorizePost() |
220 | 227 | { |
@@ -539,7 +546,8 @@ protected static function logCSRFattack() |
539 | 546 | $context['REQUEST_URI'] = $_SERVER['REQUEST_URI']; |
540 | 547 | $context['requestType'] = self::$requestType; |
541 | 548 | $context['cookie'] = $_COOKIE; |
542 | | - self::$logger->log("OWASP CSRF PROTECTOR VALIDATION FAILURE", $context); |
| 549 | + self::$logger->log( |
| 550 | + "OWASP CSRF PROTECTOR VALIDATION FAILURE", $context); |
543 | 551 | } |
544 | 552 |
|
545 | 553 | /* |
|
0 commit comments