pkp#10342 added required middleware attachment check to ValidateCsrfT…

…oken

classes/middleware/ValidateCsrfToken.php

@@ -20,15 +20,33 @@
 use Closure;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use PKP\middleware\HasUser;
+use PKP\middleware\traits\HasRequiredMiddleware;
 
 class ValidateCsrfToken
 {
+    use HasRequiredMiddleware;
+
+    /**
+     * @copydoc \PKP\middleware\traits\HasRequiredMiddleware::requiredMiddleware()
+     */
+    public function requiredMiddleware(): array
+    {
+        return [
+            HasUser::class,
+        ];
+    }
+
     /**
      * Determine and validate CSRF token
-     *
      */
     public function handle(Request $request, Closure $next)
     {
+        if (!$this->hasRequiredMiddleware($request)) {
+            // Required middleware not attached to target routes, move to next
+            return $next($request);
+        }
+
         if($this->isApiRequest($request)) {
             return $next($request);
         }

classes/middleware/traits/HasRequiredMiddleware.php

@@ -9,7 +9,7 @@
  *
  * @class HasRequiredMiddleware
  *
- * @brief Helper trait to find the required middleware attachments
+ * @brief Trait to find the required middleware attachments in a middleware
  */
 
 namespace PKP\middleware\traits;
@@ -56,10 +56,10 @@ public function hasRequiredMiddleware(Request $request, int $matchingCriteria =
         $router = app('router'); /** @var \Illuminate\Routing\Router $router */
         $routerMiddleware = $router->getMiddleware();
 
-        // need to replace the alish name with full class path
+        // need to replace the alias name with full class path
         $routeMiddleware = $routeMiddleware->map(function (string $middleware) use($routerMiddleware): string {
-            // extract the middleware class or alias name if in formar 
-            // as `has.roles:1|16|17` or `PKP\middleware\HasRoles:1|16|17`
+            // extract the middleware class or alias name if in format
+            // such as `has.roles:1|16|17` or `PKP\middleware\HasRoles:1|16|17`
             $middleware = array_shift(array_pad(explode(":", $middleware, 2), 2, []));
 
             if (class_exists($middleware)) {
@@ -76,4 +76,4 @@ public function hasRequiredMiddleware(Request $request, int $matchingCriteria =
                 => $routeMiddleware->intersect($requiredMiddleware)->count() > 0,
         };
     }
-}
+}