Changeset 8158

Timestamp:

03/30/08 18:17:00 (1 year ago)

Author:

fabien

Message:

added a form_csrf_secret setting + disabled CSRF protection by default

Files:

• branches/1.1/lib/config/config/settings.yml (modified) (1 diff)
• branches/1.1/lib/config/sfApplicationConfiguration.class.php (modified) (1 diff)
• branches/1.1/lib/form/sfForm.class.php (modified) (2 diffs)
• branches/1.1/lib/task/generator/skeleton/app/app/config/settings.yml (modified) (1 diff)

branches/1.1/lib/config/config/settings.yml

@@ -20 +20 @@
-    compressed:             off       # Enable PHP response compression. Set to on to compress the outgoing HTML via the PHP handler.
-    check_lock:             off       # Enable the application lock system triggered by the clear-cache and disable tasks. Set to on to have all requests to disabled applications redirected to the $sf_symfony_data_dir/web/arrors/unavailable.php page.
+
+    # Form security secret (CSRF protection)
+    form_csrf_secret:       false     # Unique secret to enable CSRF protection or false to disable
-
-    # Output escaping settings

branches/1.1/lib/config/sfApplicationConfiguration.class.php

@@ -103 +103 @@
-    }
-
+    if (false !== sfConfig::get('sf_form_csrf_secret'))
+    {
+      sfForm::enableCSRFProtection(sfConfig::get('sf_form_csrf_secret'));
+    }
+
-    // force setting default timezone if not set
-    if ($default_timezone = sfConfig::get('sf_default_timezone'))

branches/1.1/lib/form/sfForm.class.php

@@ -24 +24 @@
-{
-  protected static
-tru
+fals
-    $CSRFSecret     = null,
-    $CSRFFieldName  = '_csrf_token';
@@ -513 +513 @@
-  static public function enableCSRFProtection($secret = null)
-  {
+    if (false === $secret)
+    {
+      return self::disableCSRFProtection();
+    }
+
-    self::$CSRFProtection = true;
-

branches/1.1/lib/task/generator/skeleton/app/app/config/settings.yml

@@ -41 +41 @@
-#    compressed:             off       # Enable PHP response compression. Set to on to compress the outgoing HTML via the PHP handler.
-#    check_lock:             off       # Enable the application lock system triggered by the clear-cache and disable tasks. Set to on to have all requests to disabled applications redirected to the $sf_symfony_data_dir/web/arrors/unavailable.php page.
+#
+#    # Form security secret (CSRF protection)
+#    form_csrf_secret:       false     # Unique secret to enable CSRF protection or false to disable
-#
-#    # Output escaping settings