BookStack/app/Http/Middleware/StartSessionExtended.php
Dan Brown a75d5b8bc1
Sessions: Prevent image urls being part of session URL history
To prevent them being considered for redirects.
Includes test to cover.
For #4863
2024-02-22 11:23:59 +00:00

35 lines
897 B
PHP

<?php
namespace BookStack\Http\Middleware;
use Illuminate\Http\Request;
use Illuminate\Session\Middleware\StartSession as Middleware;
/**
* An extended version of the default Laravel "StartSession" middleware
* with customizations applied as required:
*
* - Adds filtering for the request URLs stored in session history.
*/
class StartSessionExtended extends Middleware
{
protected static array $pathPrefixesExcludedFromHistory = [
'uploads/images/'
];
/**
* @inheritdoc
*/
protected function storeCurrentUrl(Request $request, $session): void
{
$requestPath = strtolower($request->path());
foreach (static::$pathPrefixesExcludedFromHistory as $excludedPath) {
if (str_starts_with($requestPath, $excludedPath)) {
return;
}
}
parent::storeCurrentUrl($request, $session);
}
}