diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Form] throw an exception if session_id() is empty when a csrf token is generated

Browse Source
This commit is contained in:
Jordi Boggiano 2010-10-24 17:48:15 +02:00 committed by Fabien Potencier
parent 4c340c5cc9
commit a198bbcf43
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/Symfony/Component/Form/Form.php
View File

@ -176,7 +176,11 @@ class Form extends FieldGroup
*/
protected function generateCsrfToken($secret)
{
return md5($secret.session_id().get_class($this));
$sessId = session_id();
if (!$sessId) {
throw new \LogicException('The session must be started in order to generate a proper CSRF Token');
}
return md5($secret.$sessId.get_class($this));
}
/**

5
tests/Symfony/Tests/Component/Form/FormTest.php
View File

@ -47,6 +47,11 @@ class FormTest extends \PHPUnit_Framework_TestCase
protected $validator;
protected $form;
public static function setUpBeforeClass()
{
@session_start();
}
protected function setUp()
{
Form::disableDefaultCsrfProtection();