From ba8fd00411e81de2611f02e69e705dc2ca19dce9 Mon Sep 17 00:00:00 2001 From: Keith Solomon Date: Mon, 6 Jul 2026 23:23:32 -0500 Subject: [PATCH] refactor: route GetHomePage through the home.php template The handler had a stale inline heredoc that used a '{{ csrf }}' string substitution to inject the token. The home.php template created in Task 2 is the canonical version (uses render_layout + Escape::attr). Switching to the template removes the duplicated markup and the ad-hoc str_replace escape path. --- src/Http/Handlers/GetHomePage.php | 28 +++++----------------------- 1 file changed, 5 insertions(+), 23 deletions(-) diff --git a/src/Http/Handlers/GetHomePage.php b/src/Http/Handlers/GetHomePage.php index 82cd9be..32275ef 100644 --- a/src/Http/Handlers/GetHomePage.php +++ b/src/Http/Handlers/GetHomePage.php @@ -12,30 +12,12 @@ final class GetHomePage /** @param array $params */ public function handle(Request $request, array $params): Response { - $body = <<<'HTML' - - - - - BattleForge - - - - -

BattleForge

-

New scenario

-

Recent scenarios

-

No saved scenarios yet.

- - - -HTML; + $csrf = $request->cookies['__csrf'] ?? ''; - // The CSRF token placeholder is filled by the front controller (Task 16) - // before the body is sent. The handler does not see the cookie or the - // secret; it just receives a pre-issued token from the front controller. - $token = $request->cookies['__csrf'] ?? ''; - $body = str_replace('{{ csrf }}', htmlspecialchars($token, ENT_QUOTES, 'UTF-8'), $body); + ob_start(); + require_once __DIR__ . '/../../Views/layout.php'; + require __DIR__ . '/../../Views/home.php'; + $body = (string) ob_get_clean(); return Response::html(200, $body); }