Merge pull request from GHSA-jrqg-mpwv-pxpv

diff --git a/galette/includes/main.inc.php b/galette/includes/main.inc.php
index 9ee31b98ef18e90331bcb28321f3c91ce90330f9..0609aca80fd32614fa7ac91d01f5d4b8b76dd508 100644 (file)
--- a/galette/includes/main.inc.php
+++ b/galette/includes/main.inc.php
@@ -134,32 +134,8 @@ if ($needs_update) {
  */
 $authenticate = new Authenticate($container);
 
-/**
- * Show public pages middleware
- *
- * @param $request
- * @param $response
- * @param $next
- * @return mixed
- */
-$showPublicPages = function (Request $request, RequestHandler $handler) use ($container) {
-    $response = $handler->handle($request);
-    $login = $container->get('login');
-    $preferences = $container->get('preferences');
-
-    if (!$preferences->showPublicPages($login)) {
-        $this->get('flash')->addMessage('error', _T("Unauthorized"));
-
-        return $response
-            ->withStatus(403)
-            ->withHeader(
-                'Location',
-                $this->get(RouteParser::class)->urlFor('slash')
-            );
-    }
-
-    return $response;
-};
+//FIXME: remove in 1.1.0; routes/groups should call middleware directly
+$showPublicPages = new \Galette\Middleware\PublicPages($container);
 
 //Maintenance middleware
 if (Galette::MODE_MAINT === GALETTE_MODE && !$container->get('login')->isSuperAdmin()) {

diff --git a/galette/includes/routes/public_pages.routes.php b/galette/includes/routes/public_pages.routes.php
index 13e34f97cc5613026fd348bd719f5552615814f4..71902e007a528ab4839e7a3e3178dd5bb755e716 100644 (file)
--- a/galette/includes/routes/public_pages.routes.php
+++ b/galette/includes/routes/public_pages.routes.php
@@ -73,4 +73,4 @@ $app->group('/public', function (RouteCollectorProxy $app) use ($routeparser) {
                 ->withHeader('Location', $routeparser->urlFor('publicList', $args));
         }
     );
-})->add($showPublicPages);
+})->add(\Galette\Middleware\PublicPages::class);

diff --git a/galette/lib/Galette/Middleware/PublicPages.php b/galette/lib/Galette/Middleware/PublicPages.php
new file mode 100644 (file)
index 0000000..47a63a4
--- /dev/null
+++ b/galette/lib/Galette/Middleware/PublicPages.php
@@ -0,0 +1,113 @@
+<?php
+
+/**
+ * Copyright © 2003-2024 The Galette Team
+ *
+ * This file is part of Galette (https://galette.eu).
+ *
+ * Galette is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Galette is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Galette. If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Core
+ * @package   Galette
+ *
+ * @author    Johan Cwiklinski <johan@x-tnd.be>
+ * @copyright 2024 The Galette Team
+ * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
+ * @link      https://galette.eu
+ */
+
+namespace Galette\Middleware;
+
+use Galette\Core\Login;
+use Galette\Core\Preferences;
+use Psr\Http\Message\ServerRequestInterface as Request;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Server\RequestHandlerInterface as RequestHandler;
+use Analog\Analog;
+use DI\Container;
+use RKA\Session;
+use Slim\Flash\Messages;
+use Slim\Routing\RouteContext;
+use Slim\Routing\RouteParser;
+
+/**
+ * Galette Slim middleware for public pages access
+ *
+ * @category  Core
+ * @package   Galette
+ *
+ * @author    Johan Cwiklinski <johan@x-tnd.be>
+ * @copyright 2024 The Galette Team
+ * @license   http://www.gnu.org/licenses/gpl-3.0.html GPL License 3.0 or (at your option) any later version
+ * @link      https://galette.eu
+ */
+class PublicPages
+{
+    /**
+     * @var Messages
+     */
+    protected Messages $flash;
+
+    /**
+     * @var Login
+     */
+    private Login $login;
+
+    /**
+     * @var RouteParser
+     */
+    private RouteParser $routeparser;
+
+    /**
+     * @var Preferences
+     */
+    private Preferences $preferences;
+
+    /**
+     * Constructor
+     *
+     * @param Container $container Container instance
+     */
+    public function __construct(Container $container)
+    {
+        $this->login = $container->get('login');
+        $this->flash = $container->get('flash');
+        $this->routeparser = $container->get(RouteParser::class);
+        $this->preferences = $container->get('preferences');
+    }
+
+    /**
+     * Middleware invokable class
+     *
+     * @param Request        $request PSR7 request
+     * @param RequestHandler $handler PSR7 request handler
+     *
+     * @return Response
+     */
+    public function __invoke(Request $request, RequestHandler $handler): Response
+    {
+        $response = new \Slim\Psr7\Response();
+
+        if (!$this->preferences->showPublicPages($this->login)) {
+            $this->flash->addMessage('error_detected', _T("Unauthorized"));
+            return $response
+                ->withHeader(
+                    'Location',
+                    $this->routeparser->urlFor('slash')
+                )->withStatus(302);
+        }
+
+        return $handler->handle($request);
+    }
+}