blob: 137bc189ace93de460bd38be12a31ac5a332ac1a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
<?php
declare(strict_types=1);
namespace Drupal\Core\EventSubscriber;
use Drupal\Core\Routing\RouteMatch;
use Drupal\Core\Url;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpKernel\Event\ExceptionEvent;
/**
* Handles exceptions related to CSRF access.
*
* Redirects CSRF 403 exceptions to a _csrf_confirm_form_route.
*/
class CsrfExceptionSubscriber extends HttpExceptionSubscriberBase {
/**
* {@inheritdoc}
*/
protected function getHandledFormats(): array {
return ['html'];
}
/**
* Handles a 403 error for HTML.
*
* @param \Symfony\Component\HttpKernel\Event\ExceptionEvent $event
* The event to process.
*/
public function on403(ExceptionEvent $event): void {
$request = $event->getRequest();
$routeMatch = RouteMatch::createFromRequest($request);
$route = $routeMatch->getRouteObject();
if (!$route->hasRequirement('_csrf_token') || empty($route->getOption('_csrf_confirm_form_route'))) {
return;
}
$event->setResponse(new RedirectResponse(Url::fromRoute($route->getOption('_csrf_confirm_form_route'))->toString()));
}
}
|
