func (x *Xsrf) VerifyFor(req zerver.Request) bool {
m := req.ReqMethod()
if !x.FilterGet && (m == zerver.METHOD_GET || m == zerver.METHOD_HEAD || m == zerver.METHOD_OPTIONS) {
return true
}
token := req.GetHeader(_HEADER_XSRFTOKEN)
if token == "" {
token = req.GetHeader(_HEADER_CSRFTOKEN)
if token == "" {
token = req.Vars().QueryVar(_XSRF_PARAM_NAME)
if token == "" {
return false
}
}
}
data := x.verify(unsafe2.Bytes(token))
if data != nil {
x.Pool.Put(data)
t, ip := x.TokenInfo.Unmarshal(data)
return t != -1 &&
t+x.Timeout >= time2.Now().Unix() &&
ip == http2.IpOfAddr(req.RemoteAddr())
}
return false
}
func (j *JSONP) Filter(req zerver.Request, resp zerver.Response, chain zerver.FilterChain) {
if req.ReqMethod() != zerver.METHOD_GET {
chain(req, resp)
return
}
callback := req.Vars().QueryVar(j.CallbackVar)
if callback == "" {
chain(req, resp)
return
}
buffer := bytes.NewBuffer(make([]byte, 0, 256))
bw := wrap.BuffRespWriter{ // to avoid write header 200 first when write callback name
Buffer: buffer,
}
resp.Wrap(func(w http.ResponseWriter, shouldClose bool) (http.ResponseWriter, bool) {
bw.ResponseWriter = w
bw.ShouldClose = shouldClose
return &bw, shouldClose
})
chain(req, resp)
bw.Buffer = nil
_, err := io2.WriteString(resp, callback)
if err == nil {
_, err = io2.WriteString(resp, "(")
if err == nil {
_, err = resp.Write(buffer.Bytes())
if err == nil {
_, err = io2.WriteString(resp, ")")
}
}
}
if err != nil {
j.log.Warn(log.M{"msg": "write jsonp response failed", "err": err.Error()})
}
}
