keith/BattleForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: route GetHomePage through the home.php template

Browse Source 
The handler had a stale inline heredoc that used a '{{ csrf }}' string
substitution to inject the token. The home.php template created in Task 2
is the canonical version (uses render_layout + Escape::attr). Switching
to the template removes the duplicated markup and the ad-hoc str_replace
escape path.
This commit is contained in:
Keith Solomon
2026-07-06 23:23:32 -05:00
parent d15dfc6835
commit ba8fd00411
1 changed files with 5 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Http/Handlers/GetHomePage.php
+5 -23
View File
@@ -12,30 +12,12 @@ final class GetHomePage
/** @param array<string, string> $params */ /** @param array<string, string> $params */
public function handle(Request $request, array $params): Response public function handle(Request $request, array $params): Response
{ {
$body = <<<'HTML' $csrf = $request->cookies['__csrf'] ?? '';
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>BattleForge</title>
<link rel="stylesheet" href="/assets/styles.css">
<meta name="csrf-token" content="{{ csrf }}">
</head>
<body>
<h1>BattleForge</h1>
<p><a href="/scenarios/new/edit/team">New scenario</a></p>
<h2>Recent scenarios</h2>
<div id="recent"><p class="bf-empty">No saved scenarios yet.</p></div>
<script type="module" src="/js/storage.js"></script>
</body>
</html>
HTML;
// The CSRF token placeholder is filled by the front controller (Task 16) ob_start();
// before the body is sent. The handler does not see the cookie or the require_once __DIR__ . '/../../Views/layout.php';
// secret; it just receives a pre-issued token from the front controller. require __DIR__ . '/../../Views/home.php';
$token = $request->cookies['__csrf'] ?? ''; $body = (string) ob_get_clean();
$body = str_replace('{{ csrf }}', htmlspecialchars($token, ENT_QUOTES, 'UTF-8'), $body);
return Response::html(200, $body); return Response::html(200, $body);
} }