1
0

CSRFTokenController.php 1.9 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright 2017 Christoph Wurst <christoph@winzerhof-wurst.at>
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Roeland Jago Douma <roeland@famdouma.nl>
  8. * @author Kate Döen <kate.doeen@nextcloud.com>
  9. *
  10. * @license GNU AGPL version 3 or any later version
  11. *
  12. * This program is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License as
  14. * published by the Free Software Foundation, either version 3 of the
  15. * License, or (at your option) any later version.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  24. *
  25. */
  26. namespace OC\Core\Controller;
  27. use OC\Security\CSRF\CsrfTokenManager;
  28. use OCP\AppFramework\Controller;
  29. use OCP\AppFramework\Http;
  30. use OCP\AppFramework\Http\Attribute\FrontpageRoute;
  31. use OCP\AppFramework\Http\Attribute\OpenAPI;
  32. use OCP\AppFramework\Http\JSONResponse;
  33. use OCP\IRequest;
  34. #[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
  35. class CSRFTokenController extends Controller {
  36. public function __construct(
  37. string $appName,
  38. IRequest $request,
  39. private CsrfTokenManager $tokenManager,
  40. ) {
  41. parent::__construct($appName, $request);
  42. }
  43. /**
  44. * @NoAdminRequired
  45. * @NoCSRFRequired
  46. * @PublicPage
  47. */
  48. #[FrontpageRoute(verb: 'GET', url: '/csrftoken')]
  49. public function index(): JSONResponse {
  50. if (!$this->request->passesStrictCookieCheck()) {
  51. return new JSONResponse([], Http::STATUS_FORBIDDEN);
  52. }
  53. $requestToken = $this->tokenManager->getToken();
  54. return new JSONResponse([
  55. 'token' => $requestToken->getEncryptedValue(),
  56. ]);
  57. }
  58. }