The CsrfCounterMeasure class uses Error instead of Exceptions.
Error is PHP's internal error class for engine-level errors, things like TypeError, ParseError, ArithmeticError. These can be caught but generally not be thrown in code.
Providing an invalid CsrfToken leads to a blank Error object to be thrown when it is really an issue with a user provided Exception. Icingaweb provides a InvalidCSRFTokenException, this could be brought over to ipl-web.
Another way an error can be thrown is to call addCsrfCounterMeasure without having a csrfCounterMeasureId or uniqueId set. This should just be a LogicException
The
CsrfCounterMeasureclass uses Error instead of Exceptions.Error is PHP's internal error class for engine-level errors, things like
TypeError,ParseError,ArithmeticError. These can be caught but generally not be thrown in code.Providing an invalid CsrfToken leads to a blank
Errorobject to be thrown when it is really an issue with a user provided Exception. Icingaweb provides aInvalidCSRFTokenException, this could be brought over to ipl-web.Another way an error can be thrown is to call
addCsrfCounterMeasurewithout having acsrfCounterMeasureIdoruniqueIdset. This should just be aLogicException