diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added a way to activate CSRF protection from the configuration

Browse Source
This commit is contained in:
Fabien Potencier 2010-09-10 14:32:33 +02:00
parent 0de1c08d8d
commit 226277fd0e
7 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/Symfony/Bundle/FrameworkBundle/DependencyInjection/WebExtension.php
View File

@ -52,6 +52,12 @@ class WebExtension extends Extension
$container->setParameter('debug.file_link_format', 'txmt://open?url=file://%%f&line=%%l');
}
foreach (array('csrf_secret', 'csrf-secret') as $key) {
if (isset($config[$key])) {
$container->setParameter('csrf_secret', $config[$key]);
}
}
if (isset($config['router'])) {
if (!$container->hasDefinition('router')) {
$loader->load($this->resources['routing']);

11
src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php
View File

@ -3,6 +3,7 @@
namespace Symfony\Bundle\FrameworkBundle;
use Symfony\Framework\Bundle\Bundle;
use Symfony\Component\Form\Form;
/*
* This file is part of the Symfony framework.
@ -20,4 +21,14 @@ use Symfony\Framework\Bundle\Bundle;
*/
class FrameworkBundle extends Bundle
{
/**
* Boots the Bundle.
*/
public function boot()
{
if ($secret = $this->container->getParameter('csrf_secret')) {
Form::setDefaultCsrfSecret($secret);
Form::enableDefaultCsrfProtection();
}
}
}

1
src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd
View File

@ -17,6 +17,7 @@
</xsd:sequence>
<xsd:attribute name="ide" type="xsd:string" />
<xsd:attribute name="csrf-secret" type="xsd:string" />
</xsd:complexType>
<xsd:complexType name="profiler">

5
src/Symfony/Bundle/FrameworkBundle/Resources/skeleton/application/php/config/config.php
View File

@ -6,8 +6,9 @@ $container->loadFromExtension('kernel', 'config', array(
));
$container->loadFromExtension('web', 'config', array(
'router' => array('resource' => '%kernel.root_dir%/config/routing.php'),
'validation' => array('enabled' => true, 'annotations' => true),
'csrf-secret' => 'xxxxxxxxxx',
'router' => array('resource' => '%kernel.root_dir%/config/routing.php'),
'validation' => array('enabled' => true, 'annotations' => true),
));
$container->loadFromExtension('web', 'templating', array(

2
src/Symfony/Bundle/FrameworkBundle/Resources/skeleton/application/xml/config/config.xml
View File

@ -20,7 +20,7 @@
error_handler="null"
/>
<web:config>
<web:config csrf-secret="xxxxxxxxxx">
<web:router resource="%kernel.root_dir%/config/routing.xml" />
<web:validation enabled="true" annotations="true" />
</web:config>

5
src/Symfony/Bundle/FrameworkBundle/Resources/skeleton/application/yml/config/config.yml
View File

@ -3,8 +3,9 @@ kernel.config:
error_handler: null
web.config:
router: { resource: "%kernel.root_dir%/config/routing.yml" }
validation: { enabled: true, annotations: true }
csrf_secret: xxxxxxxxxx
router: { resource: "%kernel.root_dir%/config/routing.yml" }
validation: { enabled: true, annotations: true }
web.templating:
escaping: htmlspecialchars

2
src/Symfony/Component/Form/Form.php
View File

@ -32,7 +32,7 @@ class Form extends FieldGroup
{
protected static $defaultCsrfSecret = null;
protected static $defaultCsrfProtection = false;
protected static $defaultCsrfFieldName = '_csrf_token';
protected static $defaultCsrfFieldName = '_token';
protected static $defaultLocale = null;
protected static $defaultTranslator = null;