fix: harden sessions and domain validation

2026-09-01 18:58:18 +02:00
parent 480494c5ed
commit 9f5142b071
9 changed files with 40 additions and 16 deletions
@@ -35,9 +35,14 @@ function csrf_token(): string
    return $_SESSION['csrf'];
 }

+function scalar_input(mixed $value, string $default = ''): string
+{
+    return is_scalar($value) ? (string)$value : $default;
+}
+
 function verify_csrf(): void
 {
-    $provided = (string)($_POST['_csrf'] ?? '');
+    $provided = scalar_input($_POST['_csrf'] ?? null);
    if (!hash_equals((string)($_SESSION['csrf'] ?? ''), $provided)) {
        http_response_code(419);
        exit('Invalid CSRF token');