-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
refactor: remove deprecated properties and methods in CodeIgniter class #8050
Conversation
535a3fa
to
4195322
Compare
Looks good, needs a few other PRs. |
4195322
to
dd952f4
Compare
@@ -647,6 +617,8 @@ protected function getRequestObject() | |||
} | |||
|
|||
$this->request = Services::request(); | |||
|
|||
$this->spoofRequestMethod(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The repeat of this and the fact that spoofRequestMethod()
only works on the Request object itself makes me think this should eventually be moved into IncomingRequest. This could be a constructor override or a feature of getMethod()
(and maybe adding getRawMethod()
or something?) or a new method like getMethodWithSpoofing()
. That would also make an easy, central place to have this be configurable for security purposes: turn on/off, allow-list of methods, etc.
For this PR I think what you have is fine.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looking at the code, it is indeed all operations to the Request object.
CodeIgniter4/system/CodeIgniter.php
Lines 1027 to 1044 in 091abaf
public function spoofRequestMethod() | |
{ | |
// Only works with POSTED forms | |
if (strtolower($this->request->getMethod()) !== 'post') { | |
return; | |
} | |
$method = $this->request->getPost('_method'); | |
if (empty($method)) { | |
return; | |
} | |
// Only allows PUT, PATCH, DELETE | |
if (in_array(strtoupper($method), ['PUT', 'PATCH', 'DELETE'], true)) { | |
$this->request = $this->request->setMethod($method); | |
} | |
} |
Description
Checklist: