|
10 | 10 | if (!defined('__CSRF_PROTECTOR__')) {
|
11 | 11 | define('__CSRF_PROTECTOR__', true); // to avoid multiple declaration errors
|
12 | 12 |
|
13 |
| - // name of HTTP POST variable for authentication |
| 13 | + // Name of HTTP POST variable for authentication |
14 | 14 | define("CSRFP_TOKEN","CSRFP-Token");
|
15 | 15 |
|
16 | 16 | // We insert token name and list of url patterns for which
|
|
19 | 19 | define("CSRFP_FIELD_TOKEN_NAME", "csrfp_hidden_data_token");
|
20 | 20 | define("CSRFP_FIELD_URLS", "csrfp_hidden_data_urls");
|
21 | 21 |
|
22 |
| - /** |
23 |
| - * child exception classes |
24 |
| - */ |
| 22 | + /** Indicates configuration file was not found. */ |
25 | 23 | class configFileNotFoundException extends \exception {};
|
26 |
| - class jsFileNotFoundException extends \exception {}; |
| 24 | + |
| 25 | + /** Indicates that configuration file is incomplete. */ |
27 | 26 | class incompleteConfigurationException extends \exception {};
|
| 27 | + |
| 28 | + /** Indicates that CSRF Protector is already initialized. */ |
28 | 29 | class alreadyInitializedException extends \exception {};
|
29 | 30 |
|
30 | 31 | class csrfProtector
|
@@ -75,29 +76,38 @@ class csrfProtector
|
75 | 76 | * Variable: $config
|
76 | 77 | * config file for CSRFProtector
|
77 | 78 | * @var int Array, length = 6
|
78 |
| - * Property: #1: failedAuthAction (int) => action to be taken in case autherisation fails |
79 |
| - * Property: #3: customErrorMessage (string) => custom error message to be sent in case |
80 |
| - * of failed authentication |
81 |
| - * Property: #4: jsFile (string) => location of the CSRFProtector js file |
82 |
| - * Property: #5: tokenLength (int) => default length of hash |
83 |
| - * Property: #6: disabledJavascriptMessage (string) => error message if client's js is disabled |
| 79 | + * Property: #1: failedAuthAction (int) => action to be taken in case |
| 80 | + * autherisation fails. |
| 81 | + * Property: #3: customErrorMessage (string) => custom error message to |
| 82 | + * be sent in case of failed authentication. |
| 83 | + * Property: #4: jsFile (string) => location of the CSRFProtector js |
| 84 | + * file. |
| 85 | + * Property: #5: tokenLength (int) => default length of hash. |
| 86 | + * Property: #6: disabledJavascriptMessage (string) => error message if |
| 87 | + * client's js is disabled. |
| 88 | + * |
| 89 | + * TODO(mebjas): this field should be private |
84 | 90 | */
|
85 | 91 | public static $config = array();
|
86 | 92 |
|
87 | 93 | /*
|
88 | 94 | * Variable: $requiredConfigurations
|
89 | 95 | * Contains list of those parameters that are required to be there
|
90 | 96 | * in config file for csrfp to work
|
| 97 | + * |
| 98 | + * TODO(mebjas): this field should be private |
91 | 99 | */
|
92 |
| - public static $requiredConfigurations = array('failedAuthAction', 'jsUrl', 'tokenLength'); |
| 100 | + public static $requiredConfigurations = array( |
| 101 | + 'failedAuthAction', 'jsUrl', 'tokenLength'); |
93 | 102 |
|
94 | 103 | /*
|
95 | 104 | * Function: function to initialise the csrfProtector work flow
|
96 | 105 | *
|
97 | 106 | * Parameters:
|
98 |
| - * $length - length of CSRF_AUTH_TOKEN to be generated |
99 |
| - * $action - int array, for different actions to be taken in case of failed validation |
100 |
| - * $logger - custom logger class object |
| 107 | + * $length - (int) length of CSRF_AUTH_TOKEN to be generated. |
| 108 | + * $action - (int array), for different actions to be taken in case of |
| 109 | + * failed validation. |
| 110 | + * $logger - (LoggerInterface) custom logger class object. |
101 | 111 | *
|
102 | 112 | * Returns:
|
103 | 113 | * void
|
@@ -210,11 +220,10 @@ public static function init($length = null, $action = null, $logger = null)
|
210 | 220 | *
|
211 | 221 | * Returns:
|
212 | 222 | * void
|
213 |
| - * |
214 |
| - * Throws: |
215 |
| - * logDirectoryNotFoundException - if log directory is not found |
| 223 | + * |
| 224 | + * TODO(mebjas): this method should be private. |
216 | 225 | */
|
217 |
| - private static function authorizePost() |
| 226 | + public static function authorizePost() |
218 | 227 | {
|
219 | 228 | // TODO(mebjas): this method is valid for same origin request only,
|
220 | 229 | // enable it for cross origin also sometime for cross origin the
|
|
0 commit comments