Changeset 20298

Timestamp:

07/19/09 12:43:11 (4 years ago)

Author:

fabien

Message:

[1.2, 1.3] fixed sfForm::setDefaults() ignores individual CSRF protection (closes #6864)

Files:

• branches/1.2/lib/form/sfForm.class.php (modified) (1 diff)
• branches/1.2/test/unit/form/sfFormTest.php (modified) (2 diffs)
• branches/1.3/lib/form/sfForm.class.php (modified) (1 diff)
• branches/1.3/test/unit/form/sfFormTest.php (modified) (2 diffs)

branches/1.2/lib/form/sfForm.class.php

@@ -752 +752 @@
-    $this->defaults = is_null($defaults) ? array() : $defaults;
-
-self::$CSRFProtection
+$this->isCSRFProtected()
-    {
-      $this->setDefault(self::$CSRFFieldName, $this->getCSRFToken(self::$CSRFSecret));

branches/1.2/test/unit/form/sfFormTest.php

@@ -11 +11 @@
-require_once(dirname(__FILE__).'/../../bootstrap/unit.php');
-
-4
+5
-
-class FormTest extends sfForm
@@ -123 +123 @@
-$f->setDefaults(array('first_name' => 'Fabien'));
-$t->is($f->getDefault('_csrf_token'), $f->getCSRFToken('*mygreatsecret*'), '->getDefaults() keeps the CSRF token default value');
+
+$f = new FormTest(array(), array(), false);
+$f->setDefaults(array('first_name' => 'Fabien'));
+$t->is(array_key_exists('_csrf_token', $f->getDefaults()), false, '->setDefaults() does not set the CSRF token if CSRF is disabled');
-sfForm::disableCSRFProtection();
-

branches/1.3/lib/form/sfForm.class.php

@@ -762 +762 @@
-    $this->defaults = is_null($defaults) ? array() : $defaults;
-
-self::$CSRFProtection
+$this->isCSRFProtected()
-    {
-      $this->setDefault(self::$CSRFFieldName, $this->getCSRFToken(self::$CSRFSecret));

branches/1.3/test/unit/form/sfFormTest.php

@@ -11 +11 @@
-require_once(dirname(__FILE__).'/../../bootstrap/unit.php');
-
-6
+7
-
-class FormTest extends sfForm
@@ -123 +123 @@
-$f->setDefaults(array('first_name' => 'Fabien'));
-$t->is($f->getDefault('_csrf_token'), $f->getCSRFToken('*mygreatsecret*'), '->getDefaults() keeps the CSRF token default value');
+
+$f = new FormTest(array(), array(), false);
+$f->setDefaults(array('first_name' => 'Fabien'));
+$t->is(array_key_exists('_csrf_token', $f->getDefaults()), false, '->setDefaults() does not set the CSRF token if CSRF is disabled');
-sfForm::disableCSRFProtection();
-