Add a helper method to validate if the HTTP verb requires an XSRF check

diff --git a/wcfsetup/install/files/lib/http/middleware/Xsrf.class.php b/wcfsetup/install/files/lib/http/middleware/Xsrf.class.php
index fa8d6ad68800018e99f2e0621fd4a0c55a77d1f0..2ba683fb267b1a7f34f550cc2bf393cc318ed957 100644 (file)
--- a/wcfsetup/install/files/lib/http/middleware/Xsrf.class.php
+++ b/wcfsetup/install/files/lib/http/middleware/Xsrf.class.php
@@ -54,8 +54,7 @@ final class Xsrf implements MiddlewareInterface
         );
 
         if (
-            $request->getMethod() !== 'GET'
-            && $request->getMethod() !== 'HEAD'
+            $this->isSafeHttpMethod($request->getMethod())
             && $this->requestHandler->getActiveRequest()
         ) {
             $this->assertHasValidXsrfToken($this->requestHandler->getActiveRequest(), $hasValidXsrfToken);
@@ -64,6 +63,12 @@ final class Xsrf implements MiddlewareInterface
         return $handler->handle($request);
     }
 
+    private function isSafeHttpMethod(string $verb): bool {
+        // HTTP requests using the 'GET' or 'HEAD' verb are safe
+        // by design, because those should not alter the state.
+        return $verb === 'GET' || $verb === 'HEAD';
+    }
+
     private function assertHasValidXsrfToken(Request $request, $hasValidXsrfToken): void
     {
         if (!\is_subclass_of($request->getClassName(), RequestHandlerInterface::class)) {