Skip to content

[6.x] Allow using the signed route middleware with relative signed URLs #30336

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tonysm wants to merge 1 commit into from
Closed

[6.x] Allow using the signed route middleware with relative signed URLs #30336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions src/Illuminate/Routing/Middleware/ValidateSignature.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,15 @@ class ValidateSignature
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @param \string|\null $relative Should be the word "relative" or null.
* @return \Illuminate\Http\Response
*
* @throws \Illuminate\Routing\Exceptions\InvalidSignatureException
*/
public function handle($request, Closure $next)
public function handle($request, Closure $next, $relative = null)
Copy link
Contributor

@netpok netpok Oct 18, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This breaks compatibility with L6. It would be better to use $relative = func_get_arg(3); if the middleware handling supports it.

Copy link
Member

@driesvints driesvints Oct 18, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heya. This would indeed need to go to master because it breaks the message signature.

Copy link
Contributor Author

@tonysm tonysm Oct 19, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so I should change the base to master and aim for L7?

Copy link
Contributor

@netpok netpok Oct 19, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Either that or make it compatible with L6, as I'm pretty sure @driesvints meant the method sinature.

Have a look at accessing function parameters without changing signature.

If you chose the latter don't forget to send another pr to change the signature when this was merged.

{
if ($request->hasValidSignature()) {
// Consumers of the middleware can use the syntax "signed:relative".
if ($request->hasValidSignature($relative !== 'relative')) {
return $next($request);
}

Expand Down
15 changes: 15 additions & 0 deletions tests/Integration/Routing/UrlSigningTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,21 @@ public function testSignedMiddlewareWithRoutableParameter()
$this->assertIsString($url = URL::signedRoute('foo', $model));
$this->assertSame('routable', $this->get($url)->original);
}

public function testSignedUrlMiddlewareWithRelativePath()
{
Route::get('/foo/ipsum', function () {
return 'works';
})->name('foo')->middleware('signed:relative');

$this->assertEquals(
'works',
$this->get(url('https://fake.test'.URL::signedRoute('foo', [], null, false)))->original
);

$response = $this->get('/foo/ipsum');
$response->assertStatus(403);
}
}

class RoutableInterfaceStub implements UrlRoutable
Expand Down