BookStack Code Mirror - bookstack/blob - app/Http/Middleware/ApplyCspRules.php

   1 <?php
   2
   3 namespace BookStack\Http\Middleware;
   4
   5 use BookStack\Util\CspService;
   6 use Closure;
   7 use Illuminate\Http\Request;
   8
   9 class ApplyCspRules
  10 {
  11
  12     /**
  13      * @var CspService
  14      */
  15     protected $cspService;
  16
  17     public function __construct(CspService $cspService)
  18     {
  19         $this->cspService = $cspService;
  20     }
  21
  22     /**
  23      * Handle an incoming request.
  24      *
  25      * @param Request $request
  26      * @param Closure $next
  27      *
  28      * @return mixed
  29      */
  30     public function handle($request, Closure $next)
  31     {
  32         view()->share('cspNonce', $this->cspService->getNonce());
  33         if ($this->cspService->allowedIFrameHostsConfigured()) {
  34             config()->set('session.same_site', 'none');
  35         }
  36
  37         $response = $next($request);
  38
  39         $this->cspService->setFrameAncestors($response);
  40         $this->cspService->setScriptSrc($response);
  41
  42         return $response;
  43     }
  44
  45 }