Skip to content

Uses csrf_field and form_hidden instead of inline-html in form_open #1633

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lonnieezell merged 9 commits into from
Jan 2, 2019
Merged

Uses csrf_field and form_hidden instead of inline-html in form_open #1633

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
4d6773e
form_open enhancments (reusing existing code)
nowackipawel Dec 27, 2018
26503f2
Update FormHelperTest.php
nowackipawel Dec 27, 2018
5ab6387
Update form_helper.php
nowackipawel Dec 27, 2018
179406d
Update form_helper.php
nowackipawel Dec 27, 2018
d75517a
Update form_helper.php
nowackipawel Dec 27, 2018
d7ee702
Update FormHelperTest.php
nowackipawel Dec 27, 2018
096aa10
Update FormHelperTest.php
nowackipawel Dec 28, 2018
2c1ebbb
Update form_helper.php
nowackipawel Dec 31, 2018
0c6eeac
Update form_helper.rst
nowackipawel Dec 31, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions system/Helpers/form_helper.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,12 @@ function form_open(string $action = '', $attributes = [], array $hidden = []): s
$action = site_url($action);
}

if(is_array($attributes) && array_key_exists('csrf_id', $attributes))
{
$csrfId = $attributes['csrf_id'];
unset($attributes['csrf_id']);
}

$attributes = stringify_attributes($attributes);

if (stripos($attributes, 'method=') === false)
Expand All @@ -82,17 +88,16 @@ function form_open(string $action = '', $attributes = [], array $hidden = []): s
// Add CSRF field if enabled, but leave it out for GET requests and requests to external websites
$before = Services::filters()->getFilters()['before'];

if ((in_array('csrf', $before) || array_key_exists('csrf', $before)) && strpos($action, base_url()) !== false && ! stripos($form, 'method="get"')
)
if ((in_array('csrf', $before) || array_key_exists('csrf', $before)) && strpos($action, base_url()) !== false && ! stripos($form, 'method="get"'))
{
$hidden[csrf_token()] = csrf_hash();
$form .= csrf_field($csrfId ?? null);
}

if (is_array($hidden))
{
foreach ($hidden as $name => $value)
{
$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value, 'html') . '" style="display: none;" />' . "\n";
$form .= form_hidden($name, $value);
}
}

Expand Down Expand Up @@ -167,7 +172,7 @@ function form_hidden($name, $value = '', bool $recursing = false): string

if (! is_array($value))
{
$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value, 'html') . "\" />\n";
$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value, 'html') . "\" style=\"display:none;\" />\n";
}
else
{
Expand Down
21 changes: 11 additions & 10 deletions tests/system/Helpers/FormHelperTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ public function testFormOpenBasic()
$Name = csrf_token();
$expected = <<<EOH
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" accept-charset="utf-8">
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
<input type="hidden" name="$Name" value="$Value" style="display:none;" />

EOH;
}
Expand Down Expand Up @@ -73,7 +73,7 @@ public function testFormOpenWithoutAction()
$Name = csrf_token();
$expected = <<<EOH
<form action="http://example.com/" name="form" id="form" method="POST" accept-charset="utf-8">
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
<input type="hidden" name="$Name" value="$Value" style="display:none;" />

EOH;
}
Expand Down Expand Up @@ -110,7 +110,7 @@ public function testFormOpenWithoutMethod()
$Name = csrf_token();
$expected = <<<EOH
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="post" accept-charset="utf-8">
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
<input type="hidden" name="$Name" value="$Value" style="display:none;" />

EOH;
}
Expand Down Expand Up @@ -147,16 +147,17 @@ public function testFormOpenWithHidden()
$Name = csrf_token();
$expected = <<<EOH
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" accept-charset="utf-8">
<input type="hidden" name="foo" value="bar" style="display: none;" />
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
<input type="hidden" name="foo" value="bar" style="display:none;" />
<input type="hidden" name="$Name" value="$Value" style="display:none;" />

EOH;
}
else
{
$expected = <<<EOH
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" accept-charset="utf-8">
<input type="hidden" name="foo" value="bar" style="display: none;" />

<input type="hidden" name="foo" value="bar" style="display:none;" />

EOH;
}
Expand Down Expand Up @@ -225,7 +226,7 @@ public function testFormOpenMultipart()
$Name = csrf_token();
$expected = <<<EOH
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" enctype="multipart&#x2F;form-data" accept-charset="utf-8">
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
<input type="hidden" name="$Name" value="$Value" style="display:none;" />

EOH;
}
Expand Down Expand Up @@ -253,7 +254,7 @@ public function testFormHidden()
{
$expected = <<<EOH

<input type="hidden" name="username" value="johndoe" />\n
<input type="hidden" name="username" value="johndoe" style="display:none;" />\n
EOH;
$this->assertEquals($expected, form_hidden('username', 'johndoe'));
}
Expand All @@ -266,7 +267,7 @@ public function testFormHiddenArrayInput()
];
$expected = <<<EOH

<input type="hidden" name="foo" value="bar" />
<input type="hidden" name="foo" value="bar" style="display:none;" />

EOH;
$this->assertEquals($expected, form_hidden($data, null));
Expand All @@ -280,7 +281,7 @@ public function testFormHiddenArrayValues()
];
$expected = <<<EOH

<input type="hidden" name="name[foo]" value="bar" />
<input type="hidden" name="name[foo]" value="bar" style="display:none;" />

EOH;
$this->assertEquals($expected, form_hidden('name', $data));
Expand Down
9 changes: 9 additions & 0 deletions user_guide_src/source/helpers/form_helper.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,15 @@ The following functions are available:
The above examples would create a form similar to this::

<form method="post" accept-charset="utf-8" action="http://example.com/index.php/email/send" class="email" id="myform">

If CSRF filter is turned on `form_open()` will generate CSRF field at the beginning of the form. You can specify ID of this field by passing csrf_id as one of the $attribute array:

form_open('/u/sign-up', ['csrf_id' => 'my-id']);

will return:

<form action="/u/sign-up" method="post" accept-charset="utf-8">
<input type="hidden" id="my-id" name="csrf_field" value="964ede6e0ae8a680f7b8eab69136717d" />

**Adding Hidden Input Fields**

Expand Down