diff --git a/php/public/index.php b/php/public/index.php index 87ab0124..3fd19eaa 100644 --- a/php/public/index.php +++ b/php/public/index.php @@ -25,7 +25,6 @@ const AIO_MAX_EXECUTION_TIME = '7200'; // (2h) in case of a very slow inter const AIO_SESSION_MAX_LIFETIME = '86400'; // (24h) const AIO_COOKIE_LIFETIME = '0'; // Auto logout on browser close const AIO_LOG_ERRORS_MAX_LEN = '0'; // Log whole log messages - const AIO_TWIG_CACHE_PATH = false; // e.g., __DIR__ . '/../var/twig-cache' const AIO_DISPLAY_ERRORS = false; @@ -54,23 +53,28 @@ ini_set('session.save_path', $dataConst->GetSessionDirectory()); $app = AppFactory::create(); $responseFactory = $app->getResponseFactory(); +// Register CSRF middleware (container-only) $container->set(Guard::class, function () use ($responseFactory): Guard { $guard = new Guard($responseFactory); $guard->setPersistentTokenMode(true); return $guard; }); -// Register Middleware To Be Executed On All Routes session_start(); + +// Activate CSRF middleware for all routes $app->add(Guard::class); +// Setup and activate Twig middleware $twig = Twig::create(__DIR__ . '/../templates/', [ 'cache' => AIO_TWIG_CACHE_PATH ] ); $app->add(TwigMiddleware::create($app, $twig)); + +// Add CSRF extension to Twig so templates can access CSRF tokens $twig->addExtension(new \AIO\Twig\CsrfExtension($container->get(Guard::class))); -// Auth Middleware +// Establish and activate authentication middleware for all routes $app->add(new \AIO\Middleware\AuthMiddleware($container->get(\AIO\Auth\AuthManager::class))); //------------------------------------------------- @@ -207,20 +211,12 @@ $app->get('/setup', function (Request $request, Response $response, array $args) /** @var \AIO\Data\Setup $setup */ $setup = $container->get(\AIO\Data\Setup::class); - if(!$setup->CanBeInstalled()) { - return $view->render( - $response, - 'already-installed.twig' - ); + if (!$setup->CanBeInstalled()) { + return $view->render($response, 'already-installed.twig'); } - - return $view->render( - $response, - 'setup.twig', - [ + return $view->render($response, 'setup.twig', [ 'password' => $setup->Setup(), - ] - ); + ]); }); //------------------------------------------------- @@ -229,24 +225,16 @@ $app->get('/setup', function (Request $request, Response $response, array $args) $app->get('/', function (Request $request, Response $response, array $args) use ($container): Response { /** @var \AIO\Auth\AuthManager $authManager */ $authManager = $container->get(\AIO\Auth\AuthManager::class); - /** @var \AIO\Data\Setup $setup */ $setup = $container->get(\AIO\Data\Setup::class); - if($setup->CanBeInstalled()) { - return $response - ->withHeader('Location', 'setup') - ->withStatus(302); - } - if($authManager->IsAuthenticated()) { - return $response - ->withHeader('Location', 'containers') - ->withStatus(302); - } else { - return $response - ->withHeader('Location', 'login') - ->withStatus(302); + if ($setup->CanBeInstalled()) { + return $response->withHeader('Location', 'setup')->withStatus(302); } + if ($authManager->IsAuthenticated()) { + return $response->withHeader('Location', 'containers')->withStatus(302); + } + return $response->withHeader('Location', 'login')->withStatus(302); }); //-------------------------------------------------