2010-06-24 09:40:05 +01:00
|
|
|
<?php
|
|
|
|
|
|
|
|
/*
|
2011-01-15 13:29:43 +00:00
|
|
|
* This file is part of the Symfony package.
|
2010-10-02 11:38:11 +01:00
|
|
|
*
|
2010-06-24 09:40:05 +01:00
|
|
|
* (c) Fabien Potencier <fabien.potencier@symfony-project.com>
|
|
|
|
*
|
2011-01-15 13:29:43 +00:00
|
|
|
* For the full copyright and license information, please view the LICENSE
|
|
|
|
* file that was distributed with this source code.
|
2010-06-24 09:40:05 +01:00
|
|
|
*/
|
|
|
|
|
2011-01-15 13:29:43 +00:00
|
|
|
namespace Symfony\Component\Form;
|
|
|
|
|
2010-10-02 11:38:11 +01:00
|
|
|
use Symfony\Component\Validator\ValidatorInterface;
|
2010-12-15 14:36:47 +00:00
|
|
|
use Symfony\Component\Form\Exception\FormException;
|
2010-10-02 11:38:11 +01:00
|
|
|
|
2010-06-24 09:40:05 +01:00
|
|
|
/**
|
|
|
|
* Form represents a form.
|
|
|
|
*
|
|
|
|
* A form is composed of a validator schema and a widget form schema.
|
|
|
|
*
|
|
|
|
* Form also takes care of Csrf protection by default.
|
|
|
|
*
|
|
|
|
* A Csrf secret can be any random string. If set to false, it disables the
|
|
|
|
* Csrf protection, and if set to null, it forces the form to use the global
|
|
|
|
* Csrf secret. If the global Csrf secret is also null, then a random one
|
|
|
|
* is generated on the fly.
|
|
|
|
*
|
2010-10-17 12:45:15 +01:00
|
|
|
* @author Fabien Potencier <fabien.potencier@symfony-project.com>
|
2011-01-19 12:43:24 +00:00
|
|
|
* @author Bernhard Schussek <bernhard.schussek@symfony-project.com>
|
2010-06-24 09:40:05 +01:00
|
|
|
*/
|
|
|
|
class Form extends FieldGroup
|
|
|
|
{
|
2010-06-24 10:24:08 +01:00
|
|
|
protected $validator = null;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Constructor.
|
|
|
|
*
|
2010-10-03 22:00:47 +01:00
|
|
|
* @param string $name
|
|
|
|
* @param array|object $data
|
|
|
|
* @param ValidatorInterface $validator
|
|
|
|
* @param array $options
|
2010-06-24 10:24:08 +01:00
|
|
|
*/
|
2010-12-15 14:36:47 +00:00
|
|
|
public function __construct($name, $data = null, ValidatorInterface $validator = null, array $options = array())
|
2010-06-24 10:24:08 +01:00
|
|
|
{
|
|
|
|
$this->validator = $validator;
|
|
|
|
|
2010-12-15 14:36:47 +00:00
|
|
|
// Prefill the form with the given data
|
2010-12-21 02:59:17 +00:00
|
|
|
if (null !== $data) {
|
2010-12-15 14:36:47 +00:00
|
|
|
$this->setData($data);
|
|
|
|
}
|
2010-06-24 10:24:08 +01:00
|
|
|
|
2011-01-19 12:43:24 +00:00
|
|
|
$this->addOption('csrf_protection');
|
|
|
|
$this->addOption('csrf_field_name', '_token');
|
|
|
|
$this->addOption('csrf_secrets', array(__FILE__.php_uname()));
|
2011-01-05 11:36:04 +00:00
|
|
|
$this->addOption('field_factory');
|
2011-01-19 12:43:24 +00:00
|
|
|
$this->addOption('validation_groups');
|
|
|
|
|
|
|
|
if (isset($options['validation_groups'])) {
|
|
|
|
$options['validation_groups'] = (array)$options['validation_groups'];
|
|
|
|
}
|
2011-01-05 11:36:04 +00:00
|
|
|
|
2010-07-04 15:20:10 +01:00
|
|
|
parent::__construct($name, $options);
|
2010-12-15 14:36:47 +00:00
|
|
|
|
|
|
|
// If data is passed to this constructor, objects from parent forms
|
|
|
|
// should be ignored
|
2010-12-21 02:59:17 +00:00
|
|
|
if (null !== $data) {
|
2010-12-15 14:36:47 +00:00
|
|
|
$this->setPropertyPath(null);
|
|
|
|
}
|
2011-01-19 12:43:24 +00:00
|
|
|
|
|
|
|
// Enable CSRF protection, if necessary
|
|
|
|
if ($this->getOption('csrf_protection')) {
|
|
|
|
$field = new HiddenField($this->getOption('csrf_field_name'), array(
|
|
|
|
'property_path' => null,
|
|
|
|
));
|
|
|
|
$field->setData($this->generateCsrfToken($this->getOption('csrf_secrets')));
|
|
|
|
|
|
|
|
$this->add($field);
|
|
|
|
}
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2011-01-19 12:43:24 +00:00
|
|
|
* Returns a factory for automatically creating fields based on metadata
|
|
|
|
* available for a form's object
|
2010-06-24 10:24:08 +01:00
|
|
|
*
|
2011-01-19 12:43:24 +00:00
|
|
|
* @return FieldFactoryInterface The factory
|
2010-06-24 10:24:08 +01:00
|
|
|
*/
|
2011-01-19 12:43:24 +00:00
|
|
|
public function getFieldFactory()
|
2010-06-24 10:24:08 +01:00
|
|
|
{
|
2011-01-19 12:43:24 +00:00
|
|
|
return $this->getOption('field_factory');
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2011-01-19 12:43:24 +00:00
|
|
|
* Returns the validator used by the form
|
2010-06-24 10:24:08 +01:00
|
|
|
*
|
2011-01-19 12:43:24 +00:00
|
|
|
* @return ValidatorInterface The validator instance
|
|
|
|
*/
|
|
|
|
public function getValidator()
|
|
|
|
{
|
|
|
|
return $this->validator;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Returns the validation groups validated by the form
|
|
|
|
*
|
|
|
|
* @return array A list of validation groups or null
|
2010-06-24 10:24:08 +01:00
|
|
|
*/
|
|
|
|
public function getValidationGroups()
|
|
|
|
{
|
2011-01-19 12:43:24 +00:00
|
|
|
return $this->getOption('validation_groups');
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
|
2011-01-05 11:36:04 +00:00
|
|
|
/**
|
2011-01-19 12:43:24 +00:00
|
|
|
* Returns the name used for the CSRF protection field
|
2011-01-05 11:36:04 +00:00
|
|
|
*
|
2011-01-19 12:43:24 +00:00
|
|
|
* @return string The field name
|
2011-01-05 11:36:04 +00:00
|
|
|
*/
|
2011-01-19 12:43:24 +00:00
|
|
|
public function getCsrfFieldName()
|
2011-01-05 11:36:04 +00:00
|
|
|
{
|
2011-01-19 12:43:24 +00:00
|
|
|
return $this->getOption('csrf_field_name');
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Returns the secret values used for the CSRF protection
|
|
|
|
*
|
|
|
|
* @return array A list of string valuesf
|
|
|
|
*/
|
|
|
|
public function getCsrfSecrets()
|
|
|
|
{
|
|
|
|
return $this->getOption('csrf_secrets');
|
2011-01-05 11:36:04 +00:00
|
|
|
}
|
|
|
|
|
2010-06-24 10:24:08 +01:00
|
|
|
/**
|
|
|
|
* Binds the form with values and files.
|
|
|
|
*
|
|
|
|
* This method is final because it is very easy to break a form when
|
|
|
|
* overriding this method and adding logic that depends on $taintedFiles.
|
|
|
|
* You should override doBind() instead where the uploaded files are
|
|
|
|
* already merged into the data array.
|
|
|
|
*
|
|
|
|
* @param array $taintedValues The form data of the $_POST array
|
2010-09-09 13:40:40 +01:00
|
|
|
* @param array $taintedFiles An array of uploaded files
|
2010-06-24 10:24:08 +01:00
|
|
|
* @return boolean Whether the form is valid
|
|
|
|
*/
|
|
|
|
final public function bind($taintedValues, array $taintedFiles = null)
|
|
|
|
{
|
2010-12-21 02:59:17 +00:00
|
|
|
if (null === $taintedFiles) {
|
2010-06-24 10:24:08 +01:00
|
|
|
if ($this->isMultipart() && $this->getParent() === null) {
|
|
|
|
throw new \InvalidArgumentException('You must provide a files array for multipart forms');
|
|
|
|
}
|
|
|
|
|
|
|
|
$taintedFiles = array();
|
|
|
|
}
|
|
|
|
|
2010-09-09 14:23:28 +01:00
|
|
|
if (null === $taintedValues) {
|
|
|
|
$taintedValues = array();
|
|
|
|
}
|
|
|
|
|
2010-06-24 10:24:08 +01:00
|
|
|
$this->doBind(self::deepArrayUnion($taintedValues, $taintedFiles));
|
|
|
|
|
|
|
|
if ($this->getParent() === null) {
|
2010-12-15 14:36:47 +00:00
|
|
|
if ($this->validator === null) {
|
|
|
|
throw new FormException('A validator is required for binding. Forgot to pass it to the constructor of the form?');
|
|
|
|
}
|
|
|
|
|
2011-01-19 12:43:24 +00:00
|
|
|
if ($violations = $this->validator->validate($this, $this->getOption('validation_groups'))) {
|
2010-10-10 22:15:28 +01:00
|
|
|
// TODO: test me
|
2010-06-24 10:24:08 +01:00
|
|
|
foreach ($violations as $violation) {
|
|
|
|
$propertyPath = new PropertyPath($violation->getPropertyPath());
|
2010-10-10 22:15:28 +01:00
|
|
|
$iterator = $propertyPath->getIterator();
|
2010-06-24 10:24:08 +01:00
|
|
|
|
2010-10-10 22:15:28 +01:00
|
|
|
if ($iterator->current() == 'data') {
|
2010-06-24 10:24:08 +01:00
|
|
|
$type = self::DATA_ERROR;
|
2010-10-10 22:15:28 +01:00
|
|
|
$iterator->next(); // point at the first data element
|
2010-06-24 10:24:08 +01:00
|
|
|
} else {
|
|
|
|
$type = self::FIELD_ERROR;
|
|
|
|
}
|
|
|
|
|
2010-11-18 22:33:44 +00:00
|
|
|
$this->addError(new FieldError($violation->getMessageTemplate(), $violation->getMessageParameters()), $iterator, $type);
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Binds the form with the given data.
|
|
|
|
*
|
|
|
|
* @param array $taintedData The data to bind to the form
|
|
|
|
* @return boolean Whether the form is valid
|
|
|
|
*/
|
|
|
|
protected function doBind(array $taintedData)
|
|
|
|
{
|
|
|
|
parent::bind($taintedData);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2010-10-10 22:30:43 +01:00
|
|
|
* Returns a CSRF token for the given CSRF secret
|
2010-06-24 10:24:08 +01:00
|
|
|
*
|
|
|
|
* If you want to change the algorithm used to compute the token, you
|
|
|
|
* can override this method.
|
|
|
|
*
|
2010-10-10 22:30:43 +01:00
|
|
|
* @param string $secret The secret string to use
|
2010-06-24 10:24:08 +01:00
|
|
|
*
|
|
|
|
* @return string A token string
|
|
|
|
*/
|
2011-01-19 12:43:24 +00:00
|
|
|
protected function generateCsrfToken(array $secrets)
|
2010-06-24 10:24:08 +01:00
|
|
|
{
|
2011-01-19 12:43:24 +00:00
|
|
|
$implodedSecrets = get_class($this);
|
2011-01-03 16:00:28 +00:00
|
|
|
|
2011-01-19 12:43:24 +00:00
|
|
|
foreach ($secrets as $secret) {
|
|
|
|
if ($secret instanceof \Closure) {
|
|
|
|
$secret = $secret();
|
2011-01-03 16:00:28 +00:00
|
|
|
}
|
|
|
|
|
2011-01-19 12:43:24 +00:00
|
|
|
$implodedSecrets .= $secret;
|
2010-10-24 16:48:15 +01:00
|
|
|
}
|
2011-01-03 16:00:28 +00:00
|
|
|
|
2011-01-19 12:43:24 +00:00
|
|
|
return md5($implodedSecrets);
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @return true if this form is CSRF protected
|
|
|
|
*/
|
|
|
|
public function isCsrfProtected()
|
|
|
|
{
|
2011-01-19 12:43:24 +00:00
|
|
|
return $this->has($this->getOption('csrf_field_name'));
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Returns whether the CSRF token is valid
|
|
|
|
*
|
|
|
|
* @return boolean
|
|
|
|
*/
|
|
|
|
public function isCsrfTokenValid()
|
|
|
|
{
|
|
|
|
if (!$this->isCsrfProtected()) {
|
|
|
|
return true;
|
|
|
|
} else {
|
2011-01-19 12:43:24 +00:00
|
|
|
$actual = $this->get($this->getOption('csrf_field_name'))->getDisplayedData();
|
|
|
|
$expected = $this->generateCsrfToken($this->getOption('csrf_secrets'));
|
|
|
|
|
|
|
|
return $actual === $expected;
|
2010-06-24 10:24:08 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Returns whether the maximum POST size was reached in this request.
|
|
|
|
*
|
|
|
|
* @return boolean
|
|
|
|
*/
|
|
|
|
public function isPostMaxSizeReached()
|
|
|
|
{
|
|
|
|
if (isset($_SERVER['CONTENT_LENGTH'])) {
|
|
|
|
$length = (int) $_SERVER['CONTENT_LENGTH'];
|
|
|
|
$max = trim(ini_get('post_max_size'));
|
|
|
|
|
|
|
|
switch (strtolower(substr($max, -1))) {
|
|
|
|
// The 'G' modifier is available since PHP 5.1.0
|
|
|
|
case 'g':
|
|
|
|
$max *= 1024;
|
|
|
|
case 'm':
|
|
|
|
$max *= 1024;
|
|
|
|
case 'k':
|
|
|
|
$max *= 1024;
|
|
|
|
}
|
|
|
|
|
|
|
|
return $length > $max;
|
|
|
|
} else {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Merges two arrays without reindexing numeric keys.
|
|
|
|
*
|
|
|
|
* @param array $array1 An array to merge
|
|
|
|
* @param array $array2 An array to merge
|
|
|
|
*
|
|
|
|
* @return array The merged array
|
|
|
|
*/
|
|
|
|
static protected function deepArrayUnion($array1, $array2)
|
|
|
|
{
|
|
|
|
foreach ($array2 as $key => $value) {
|
|
|
|
if (is_array($value) && isset($array1[$key]) && is_array($array1[$key])) {
|
|
|
|
$array1[$key] = self::deepArrayUnion($array1[$key], $value);
|
|
|
|
} else {
|
|
|
|
$array1[$key] = $value;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return $array1;
|
|
|
|
}
|
2010-06-24 09:40:05 +01:00
|
|
|
}
|