Merge pull request #5228 from kenjis/csrf-put-patch-delete

Add CSRF Protection for PUT/PATCH/DELETE

Author: kenjis

system/Filters/Filters.php

@@ -443,7 +443,7 @@ protected function processMethods()
         }
 
         // Request method won't be set for CLI-based requests
-        $method = strtolower($_SERVER['REQUEST_METHOD'] ?? 'cli');
+        $method = strtolower($this->request->getMethod()) ?? 'cli';
 
         if (array_key_exists($method, $this->config->methods)) {
             $this->filters['before'] = array_merge($this->filters['before'], $this->config->methods[$method]);

system/Security/Security.php

@@ -259,18 +259,20 @@ public function getCSRFTokenName(): string
      *
      * @throws SecurityException
      *
-     * @return $this|false
+     * @return $this
      */
     public function verify(RequestInterface $request)
     {
-        // If it's not a POST request we will set the CSRF cookie.
-        if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') {
-            return $this->sendCookie($request);
+        // Protects POST, PUT, DELETE, PATCH
+        $method           = strtoupper($request->getMethod());
+        $methodsToProtect = ['POST', 'PUT', 'DELETE', 'PATCH'];
+        if (! in_array($method, $methodsToProtect, true)) {
+            return $this;
         }
 
         $token = $this->getPostedToken($request);
 
-        // Does the tokens exist in both the POST/POSTed JSON and COOKIE arrays and match?
+        // Do the tokens match?
         if (! isset($token, $this->hash) || ! hash_equals($this->hash, $token)) {
             throw SecurityException::forDisallowedAction();
         }