Differential D25040 Diff 97 src/aphront/AphrontRequest.php

Changeset View

Standalone View

src/aphront/AphrontRequest.php

Show First 20 Lines • Show All 348 Lines • ▼ Show 20 Lines	public function validateCSRF() {
if (!$valid) {		if (!$valid) {

// Add some diagnostic details so we can figure out if some CSRF issues		// Add some diagnostic details so we can figure out if some CSRF issues
// are JS problems or people accessing Ajax URIs directly with their		// are JS problems or people accessing Ajax URIs directly with their
// browsers.		// browsers.
$info = array();		$info = array();

$info[] = pht(		$info[] = pht(
'You are trying to save some data to Phabricator, but the request '.		'You are trying to save some data to permanent storage, but the '.
'your browser made included an incorrect token. Reload the page '.		'request your browser made included an incorrect token. Reload the '.
'and try again. You may need to clear your cookies.');		'page and try again. You may need to clear your cookies.');

if ($this->isAjax()) {		if ($this->isAjax()) {
$info[] = pht('This was an Ajax request.');		$info[] = pht('This was an Ajax request.');
} else {		} else {
$info[] = pht('This was a Web request.');		$info[] = pht('This was a Web request.');
}		}

if ($token) {		if ($token) {
▲ Show 20 Lines • Show All 214 Lines • ▼ Show 20 Lines	private function setCookieWithExpiration(
$base_domain_uri = $this->getCookieDomainURI();		$base_domain_uri = $this->getCookieDomainURI();
if (!$base_domain_uri) {		if (!$base_domain_uri) {
$configured_as = PhabricatorEnv::getEnvConfig('phabricator.base-uri');		$configured_as = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
$accessed_as = $this->getHost();		$accessed_as = $this->getHost();

throw new AphrontMalformedRequestException(		throw new AphrontMalformedRequestException(
pht('Bad Host Header'),		pht('Bad Host Header'),
pht(		pht(
'This Phabricator install is configured as "%s", but you are '.		'This server is configured as "%s", but you are using the domain '.
'using the domain name "%s" to access a page which is trying to '.		'name "%s" to access a page which is trying to set a cookie. '.
'set a cookie. Access Phabricator on the configured primary '.		'Access this service on the configured primary domain or a '.
'domain or a configured alternate domain. Phabricator will not '.		'configured alternate domain. Cookies will not be set on other '.
'set cookies on other domains for security reasons.',		'domains for security reasons.',
$configured_as,		$configured_as,
$accessed_as),		$accessed_as),
true);		true);
}		}

$base_domain = $base_domain_uri->getDomain();		$base_domain = $base_domain_uri->getDomain();
$is_secure = ($base_domain_uri->getProtocol() == 'https');		$is_secure = ($base_domain_uri->getProtocol() == 'https');

▲ Show 20 Lines • Show All 368 Lines • Show Last 20 Lines