diff options
author | Andrew Dolgov <[email protected]> | 2023-10-25 12:55:09 +0300 |
---|---|---|
committer | Andrew Dolgov <[email protected]> | 2023-10-25 12:55:09 +0300 |
commit | 865ecc87963dc3b26e66296616eef2a1cc41ac3f (patch) | |
tree | bf2ecd8a391103bdb2c8b70cd33c47467310754b /classes/PluginHandler.php | |
parent | 0a5507d3bd79d04c860455664f919bf8e7274fda (diff) |
move to psr-4 autoloader
Diffstat (limited to 'classes/PluginHandler.php')
-rw-r--r-- | classes/PluginHandler.php | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/classes/PluginHandler.php b/classes/PluginHandler.php new file mode 100644 index 000000000..a6f0a4965 --- /dev/null +++ b/classes/PluginHandler.php @@ -0,0 +1,29 @@ +<?php +class PluginHandler extends Handler_Protected { + function csrf_ignore(string $method): bool { + return true; + } + + function catchall(string $method): void { + $plugin_name = clean($_REQUEST["plugin"]); + $plugin = PluginHost::getInstance()->get_plugin($plugin_name); + $csrf_token = ($_POST["csrf_token"] ?? ""); + + if ($plugin) { + if (method_exists($plugin, $method)) { + if (validate_csrf($csrf_token) || $plugin->csrf_ignore($method)) { + $plugin->$method(); + } else { + user_error("Rejected {$plugin_name}->{$method}(): invalid CSRF token.", E_USER_WARNING); + print Errors::to_json(Errors::E_UNAUTHORIZED); + } + } else { + user_error("Rejected {$plugin_name}->{$method}(): unknown method.", E_USER_WARNING); + print Errors::to_json(Errors::E_UNKNOWN_METHOD); + } + } else { + user_error("Rejected {$plugin_name}->{$method}(): unknown plugin.", E_USER_WARNING); + print Errors::to_json(Errors::E_UNKNOWN_PLUGIN); + } + } +} |