Refactoring: added controlled middleware and changed response class

1 files changed, 209 insertions, 146 deletions

diff --git a/app/Core/Http/Response.php b/app/Core/Http/Response.php
index 996fc58d..fd67ec95 100644
--- a/app/Core/Http/Response.php
+++ b/app/Core/Http/Response.php
@@ -13,296 +13,359 @@ use Kanboard\Core\Csv;
  */
 class Response extends Base
 {
+    private $httpStatusCode = 200;
+    private $httpHeaders = array();
+    private $httpBody = '';
+
     /**
-     * Send headers to cache a resource
+     * Set HTTP status code
      *
      * @access public
-     * @param  integer $duration
-     * @param  string  $etag
+     * @param  integer $statusCode
+     * @return $this
      */
-    public function cache($duration, $etag = '')
+    public function withStatusCode($statusCode)
     {
-        header('Pragma: cache');
-        header('Expires: ' . gmdate('D, d M Y H:i:s', time() + $duration) . ' GMT');
-        header('Cache-Control: public, max-age=' . $duration);
-
-        if ($etag) {
-            header('ETag: "' . $etag . '"');
-        }
+        $this->httpStatusCode = $statusCode;
+        return $this;
     }
 
     /**
-     * Send no cache headers
+     * Set HTTP header
      *
      * @access public
+     * @param  string $header
+     * @param  string $value
+     * @return $this
      */
-    public function nocache()
+    public function withHeader($header, $value)
     {
-        header('Pragma: no-cache');
-        header('Expires: Sat, 26 Jul 1997 05:00:00 GMT');
-
-        // Use no-store due to a Chrome bug: https://code.google.com/p/chromium/issues/detail?id=28035
-        header('Cache-Control: no-store, must-revalidate');
+        $this->httpHeaders[$header] = $value;
+        return $this;
     }
 
     /**
-     * Send a custom Content-Type header
+     * Set content type header
      *
      * @access public
-     * @param  string   $mimetype   Mime-type
+     * @param  string $value
+     * @return $this
      */
-    public function contentType($mimetype)
+    public function withContentType($value)
     {
-        header('Content-Type: '.$mimetype);
+        $this->httpHeaders['Content-Type'] = $value;
+        return $this;
     }
 
     /**
-     * Force the browser to download an attachment
+     * Set default security headers
      *
      * @access public
-     * @param  string   $filename    File name
+     * @return $this
      */
-    public function forceDownload($filename)
+    public function withSecurityHeaders()
     {
-        header('Content-Disposition: attachment; filename="'.$filename.'"');
-        header('Content-Transfer-Encoding: binary');
-        header('Content-Type: application/octet-stream');
+        $this->httpHeaders['X-Content-Type-Options'] = 'nosniff';
+        $this->httpHeaders['X-XSS-Protection'] = '1; mode=block';
+        return $this;
     }
 
     /**
-     * Send a custom HTTP status code
+     * Set header Content-Security-Policy
      *
      * @access public
-     * @param  integer   $status_code   HTTP status code
+     * @param  array  $policies
+     * @return $this
      */
-    public function status($status_code)
+    public function withContentSecurityPolicy(array $policies = array())
     {
-        header('Status: '.$status_code);
-        header($this->request->getServerVariable('SERVER_PROTOCOL').' '.$status_code);
+        $values = '';
+
+        foreach ($policies as $policy => $acl) {
+            $values .= $policy.' '.trim($acl).'; ';
+        }
+
+        $this->withHeader('Content-Security-Policy', $values);
+        return $this;
     }
 
     /**
-     * Redirect to another URL
+     * Set header X-Frame-Options
      *
      * @access public
-     * @param  string   $url   Redirection URL
-     * @param  boolean  $self  If Ajax request and true: refresh the current page
+     * @return $this
      */
-    public function redirect($url, $self = false)
+    public function withXframe()
     {
-        if ($this->request->isAjax()) {
-            header('X-Ajax-Redirect: '.($self ? 'self' : $url));
-        } else {
-            header('Location: '.$url);
-        }
-
-        exit;
+        $this->withHeader('X-Frame-Options', 'DENY');
+        return $this;
     }
 
     /**
-     * Send a CSV response
+     * Set header Strict-Transport-Security (only if we use HTTPS)
      *
      * @access public
-     * @param  array    $data          Data to serialize in csv
-     * @param  integer  $status_code   HTTP status code
+     * @return $this
      */
-    public function csv(array $data, $status_code = 200)
+    public function withStrictTransportSecurity()
     {
-        $this->status($status_code);
-        $this->nocache();
+        if ($this->request->isHTTPS()) {
+            $this->withHeader('Strict-Transport-Security', 'max-age=31536000');
+        }
 
-        header('Content-Type: text/csv');
-        Csv::output($data);
-        exit;
+        return $this;
     }
 
     /**
-     * Send a Json response
+     * Set HTTP response body
      *
      * @access public
-     * @param  array    $data          Data to serialize in json
-     * @param  integer  $status_code   HTTP status code
+     * @param  string $body
+     * @return $this
      */
-    public function json(array $data, $status_code = 200)
+    public function withBody($body)
     {
-        $this->status($status_code);
-        $this->nocache();
-        header('Content-Type: application/json');
-        echo json_encode($data);
-        exit;
+        $this->httpBody = $body;
+        return $this;
     }
 
     /**
-     * Send a text response
+     * Send headers to cache a resource
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
+     * @param  integer $duration
+     * @param  string  $etag
+     * @return $this
      */
-    public function text($data, $status_code = 200)
+    public function withCache($duration, $etag = '')
     {
-        $this->status($status_code);
-        $this->nocache();
-        header('Content-Type: text/plain; charset=utf-8');
-        echo $data;
-        exit;
+        $this
+            ->withHeader('Pragma', 'cache')
+            ->withHeader('Expires', gmdate('D, d M Y H:i:s', time() + $duration) . ' GMT')
+            ->withHeader('Cache-Control', 'public, max-age=' . $duration)
+        ;
+
+        if ($etag) {
+            $this->withHeader('ETag', '"' . $etag . '"');
+        }
+
+        return $this;
     }
 
     /**
-     * Send a HTML response
+     * Send no cache headers
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
+     * @return $this
      */
-    public function html($data, $status_code = 200)
+    public function withoutCache()
     {
-        $this->status($status_code);
-        $this->nocache();
-        header('Content-Type: text/html; charset=utf-8');
-        echo $data;
-        exit;
+        $this->withHeader('Pragma', 'no-cache');
+        $this->withHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT');
+        return $this;
     }
 
     /**
-     * Send a XML response
+     * Force the browser to download an attachment
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
+     * @param  string $filename
+     * @return $this
      */
-    public function xml($data, $status_code = 200)
+    public function withDownload($filename)
     {
-        $this->status($status_code);
-        $this->nocache();
-        header('Content-Type: text/xml; charset=utf-8');
-        echo $data;
-        exit;
+        $this->withHeader('Content-Disposition', 'attachment; filename="'.$filename.'"');
+        $this->withHeader('Content-Transfer-Encoding', 'binary');
+        $this->withHeader('Content-Type', 'application/octet-stream');
+        return $this;
     }
 
     /**
-     * Send a javascript response
+     * Send headers and body
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
      */
-    public function js($data, $status_code = 200)
+    public function send()
     {
-        $this->status($status_code);
+        if ($this->httpStatusCode !== 200) {
+            header('Status: '.$this->httpStatusCode);
+            header($this->request->getServerVariable('SERVER_PROTOCOL').' '.$this->httpStatusCode);
+        }
 
-        header('Content-Type: text/javascript; charset=utf-8');
-        echo $data;
+        foreach ($this->httpHeaders as $header => $value) {
+            header($header.': '.$value);
+        }
 
-        exit;
+        if (! empty($this->httpBody)) {
+            echo $this->httpBody;
+        }
     }
 
     /**
-     * Send a css response
+     * Send a custom HTTP status code
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
+     * @param  integer $statusCode
      */
-    public function css($data, $status_code = 200)
+    public function status($statusCode)
     {
-        $this->status($status_code);
+        $this->withStatusCode($statusCode);
+        $this->send();
+    }
 
-        header('Content-Type: text/css; charset=utf-8');
-        echo $data;
+    /**
+     * Redirect to another URL
+     *
+     * @access public
+     * @param  string   $url   Redirection URL
+     * @param  boolean  $self  If Ajax request and true: refresh the current page
+     */
+    public function redirect($url, $self = false)
+    {
+        if ($this->request->isAjax()) {
+            $this->withHeader('X-Ajax-Redirect', $self ? 'self' : $url);
+        } else {
+            $this->withHeader('Location', $url);
+        }
 
-        exit;
+        $this->send();
     }
 
     /**
-     * Send a binary response
+     * Send a HTML response
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
+     * @param  string  $data
+     * @param  integer $statusCode
      */
-    public function binary($data, $status_code = 200)
+    public function html($data, $statusCode = 200)
     {
-        $this->status($status_code);
-        $this->nocache();
-        header('Content-Transfer-Encoding: binary');
-        header('Content-Type: application/octet-stream');
-        echo $data;
-        exit;
+        $this->withStatusCode($statusCode);
+        $this->withContentType('text/html; charset=utf-8');
+        $this->withBody($data);
+        $this->send();
     }
 
     /**
-     * Send a iCal response
+     * Send a text response
      *
      * @access public
-     * @param  string   $data          Raw data
-     * @param  integer  $status_code   HTTP status code
+     * @param  string   $data
+     * @param  integer  $statusCode
      */
-    public function ical($data, $status_code = 200)
+    public function text($data, $statusCode = 200)
     {
-        $this->status($status_code);
-        $this->contentType('text/calendar; charset=utf-8');
-        echo $data;
+        $this->withStatusCode($statusCode);
+        $this->withContentType('text/plain; charset=utf-8');
+        $this->withBody($data);
+        $this->send();
     }
 
     /**
-     * Send the security header: Content-Security-Policy
+     * Send a CSV response
      *
      * @access public
-     * @param  array    $policies   CSP rules
+     * @param  array  $data  Data to serialize in csv
      */
-    public function csp(array $policies = array())
+    public function csv(array $data)
     {
-        $values = '';
+        $this->withoutCache();
+        $this->withContentType('text/csv; charset=utf-8');
+        $this->send();
+        Csv::output($data);
+    }
 
-        foreach ($policies as $policy => $acl) {
-            $values .= $policy.' '.trim($acl).'; ';
-        }
+    /**
+     * Send a Json response
+     *
+     * @access public
+     * @param  array    $data         Data to serialize in json
+     * @param  integer  $statusCode   HTTP status code
+     */
+    public function json(array $data, $statusCode = 200)
+    {
+        $this->withStatusCode($statusCode);
+        $this->withContentType('application/json');
+        $this->withoutCache();
+        $this->withBody(json_encode($data));
+        $this->send();
+    }
 
-        header('Content-Security-Policy: '.$values);
+    /**
+     * Send a XML response
+     *
+     * @access public
+     * @param  string   $data
+     * @param  integer  $statusCode
+     */
+    public function xml($data, $statusCode = 200)
+    {
+        $this->withStatusCode($statusCode);
+        $this->withContentType('text/xml; charset=utf-8');
+        $this->withoutCache();
+        $this->withBody($data);
+        $this->send();
     }
 
     /**
-     * Send the security header: X-Content-Type-Options
+     * Send a javascript response
      *
      * @access public
+     * @param  string  $data
+     * @param  integer $statusCode
      */
-    public function nosniff()
+    public function js($data, $statusCode = 200)
     {
-        header('X-Content-Type-Options: nosniff');
+        $this->withStatusCode($statusCode);
+        $this->withContentType('text/javascript; charset=utf-8');
+        $this->withBody($data);
+        $this->send();
     }
 
     /**
-     * Send the security header: X-XSS-Protection
+     * Send a css response
      *
      * @access public
+     * @param  string  $data
+     * @param  integer $statusCode
      */
-    public function xss()
+    public function css($data, $statusCode = 200)
     {
-        header('X-XSS-Protection: 1; mode=block');
+        $this->withStatusCode($statusCode);
+        $this->withContentType('text/css; charset=utf-8');
+        $this->withBody($data);
+        $this->send();
     }
 
     /**
-     * Send the security header: Strict-Transport-Security (only if we use HTTPS)
+     * Send a binary response
      *
      * @access public
+     * @param  string  $data
+     * @param  integer $statusCode
      */
-    public function hsts()
+    public function binary($data, $statusCode = 200)
     {
-        if ($this->request->isHTTPS()) {
-            header('Strict-Transport-Security: max-age=31536000');
-        }
+        $this->withStatusCode($statusCode);
+        $this->withoutCache();
+        $this->withHeader('Content-Transfer-Encoding', 'binary');
+        $this->withContentType('application/octet-stream');
+        $this->withBody($data);
+        $this->send();
     }
 
     /**
-     * Send the security header: X-Frame-Options (deny by default)
+     * Send a iCal response
      *
      * @access public
-     * @param  string   $mode   Frame option mode
-     * @param  array    $urls   Allowed urls for the given mode
+     * @param  string  $data
+     * @param  integer $statusCode
      */
-    public function xframe($mode = 'DENY', array $urls = array())
+    public function ical($data, $statusCode = 200)
     {
-        header('X-Frame-Options: '.$mode.' '.implode(' ', $urls));
+        $this->withStatusCode($statusCode);
+        $this->withContentType('text/calendar; charset=utf-8');
+        $this->withBody($data);
+        $this->send();
     }
 }