diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[FrameworkBundle] added $view['form']->csrfToken() helper

Browse Source
This commit is contained in:
Kris Wallsmith 2012-01-10 04:56:30 -08:00
parent e1aced89fd
commit 753c06761a
4 changed files with 40 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/Symfony/Bundle/FrameworkBundle/Resources/config/templating_php.xml
View File

@ -97,6 +97,7 @@
<service id="templating.helper.form" class="%templating.helper.form.class%">
<tag name="templating.helper" alias="form" />
<argument type="service" id="templating.engine.php" />
<argument type="service" id="form.csrf_provider" />
<argument>%templating.helper.form.resources%</argument>
</service>

41
src/Symfony/Bundle/FrameworkBundle/Templating/Helper/FormHelper.php
View File

@ -15,6 +15,7 @@ use Symfony\Component\Templating\Helper\Helper;
use Symfony\Component\Templating\EngineInterface;
use Symfony\Component\Form\FormView;
use Symfony\Component\Form\Exception\FormException;
use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface;
use Symfony\Component\Form\Util\FormUtil;
/**
@ -27,6 +28,8 @@ class FormHelper extends Helper
{
protected $engine;
protected $csrfProvider;
protected $varStack;
protected $context;
@ -38,14 +41,16 @@ class FormHelper extends Helper
protected $templates;
/**
* Constructor;
* Constructor.
*
* @param EngineInterface $engine The templating engine
* @param array $resources An array of theme name
* @param EngineInterface $engine The templating engine
* @param CsrfProviderInterface $csrfProvider The CSRF provider
* @param array $resources An array of theme names
*/
public function __construct(EngineInterface $engine, array $resources)
public function __construct(EngineInterface $engine, CsrfProviderInterface $csrfProvider, array $resources)
{
$this->engine = $engine;
$this->csrfProvider = $csrfProvider;
$this->resources = $resources;
$this->varStack = array();
$this->context = array();
@ -172,6 +177,34 @@ class FormHelper extends Helper
return $this->renderSection($view, 'rest', $variables);
}
/**
* Returns a CSRF token.
*
* Use this helper for CSRF protection without the overhead of creating a
* form.
*
* <code>
* echo $view['form']->csrfToken('rm_user_'.$user->getId());
* </code>
*
* Check the token in your action using the same intention.
*
* <code>
* $csrfProvider = $this->get('form.csrf_provider');
* if (!$csrfProvider->isCsrfTokenValid('rm_user_'.$user->getId(), $token)) {
* throw new \RuntimeException('CSRF attack detected.');
* }
* </code>
*
* @param string $intention The intention of the protected action
*
* @return string A CSRF token
*/
public function csrfToken($intention)
{
return $this->csrfProvider->generateCsrfToken($intention);
}
/**
* Renders a template.
*

2
src/Symfony/Bundle/FrameworkBundle/Tests/Templating/Helper/FormHelperDivLayoutTest.php
View File

@ -37,7 +37,7 @@ class FormHelperDivLayoutTest extends AbstractDivLayoutTest
$loader = new FilesystemLoader(array());
$engine = new PhpEngine($templateNameParser, $loader);
$this->helper = new FormHelper($engine, array('FrameworkBundle:Form'));
$this->helper = new FormHelper($engine, $this->getMock('Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface'), array('FrameworkBundle:Form'));
$engine->setHelpers(array(
$this->helper,

2
src/Symfony/Bundle/FrameworkBundle/Tests/Templating/Helper/FormHelperTableLayoutTest.php
View File

@ -37,7 +37,7 @@ class FormHelperTableLayoutTest extends AbstractTableLayoutTest
$loader = new FilesystemLoader(array());
$engine = new PhpEngine($templateNameParser, $loader);
$this->helper = new FormHelper($engine, array(
$this->helper = new FormHelper($engine, $this->getMock('Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface'), array(
'FrameworkBundle:Form',
'FrameworkBundle:FormTable'
));