[Form] don't allow users to force exceptions by submitting unexpected data
this makes it more fault-tolerant by simply ignoring wrong stuff from hackers [Form] added test to ensure binding of wrong data is ignored
This commit is contained in:
parent
deb41a10de
commit
eb2eba17e3
@ -13,7 +13,6 @@ namespace Symfony\Component\Form;
|
|||||||
|
|
||||||
use Symfony\Component\Form\Exception\FormException;
|
use Symfony\Component\Form\Exception\FormException;
|
||||||
use Symfony\Component\Form\Exception\AlreadyBoundException;
|
use Symfony\Component\Form\Exception\AlreadyBoundException;
|
||||||
use Symfony\Component\Form\Exception\UnexpectedTypeException;
|
|
||||||
use Symfony\Component\Form\Exception\TransformationFailedException;
|
use Symfony\Component\Form\Exception\TransformationFailedException;
|
||||||
use Symfony\Component\Form\Util\FormUtil;
|
use Symfony\Component\Form\Util\FormUtil;
|
||||||
use Symfony\Component\Form\Util\PropertyPath;
|
use Symfony\Component\Form\Util\PropertyPath;
|
||||||
@ -533,10 +532,6 @@ class Form implements \IteratorAggregate, FormInterface
|
|||||||
// (think of empty collection forms)
|
// (think of empty collection forms)
|
||||||
if ($this->config->getCompound()) {
|
if ($this->config->getCompound()) {
|
||||||
if (!is_array($submittedData)) {
|
if (!is_array($submittedData)) {
|
||||||
if (!FormUtil::isEmpty($submittedData)) {
|
|
||||||
throw new UnexpectedTypeException($submittedData, 'array');
|
|
||||||
}
|
|
||||||
|
|
||||||
$submittedData = array();
|
$submittedData = array();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -779,6 +779,25 @@ class SimpleFormTest extends AbstractFormTest
|
|||||||
$form->setData('foo');
|
$form->setData('foo');
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public function testBindingWrongDataIsIgnored()
|
||||||
|
{
|
||||||
|
$test = $this;
|
||||||
|
|
||||||
|
$child = $this->getBuilder('child', $this->dispatcher);
|
||||||
|
$child->addEventListener(FormEvents::PRE_BIND, function (FormEvent $event) use ($test) {
|
||||||
|
// child form doesn't receive the wrong data that is bound on parent
|
||||||
|
$test->assertNull($event->getData());
|
||||||
|
});
|
||||||
|
|
||||||
|
$parent = $this->getBuilder('parent', new EventDispatcher())
|
||||||
|
->setCompound(true)
|
||||||
|
->setDataMapper($this->getDataMapper())
|
||||||
|
->add($child)
|
||||||
|
->getForm();
|
||||||
|
|
||||||
|
$parent->bind('not-an-array');
|
||||||
|
}
|
||||||
|
|
||||||
protected function createForm()
|
protected function createForm()
|
||||||
{
|
{
|
||||||
return $this->getBuilder()->getForm();
|
return $this->getBuilder()->getForm();
|
||||||
|
Reference in New Issue
Block a user