bug #9333 [2.2][Form] Improved FormTypeCsrfExtension to use the type class as default intention if the form name is empty (bschussek)

fabpot · fabpot · commit 2a637b12b4ae · 2013-10-18T16:57:55.000+02:00
This PR was merged into the 2.2 branch. Discussion ---------- [2.2][Form] Improved FormTypeCsrfExtension to use the type class as default intention if the form name is empty | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - ping @stof follow-up PR to #9327 Commits ------- 219e44d [Intl] Improved FormTypeCsrfExtension to use the type class as default intention if the form name is empty
diff --git a/src/Symfony/Component/Form/Extension/Csrf/Type/FormTypeCsrfExtension.php b/src/Symfony/Component/Form/Extension/Csrf/Type/FormTypeCsrfExtension.php
@@ -52,7 +52,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)
             ->addEventSubscriber(new CsrfValidationListener(
                 $options['csrf_field_name'],
                 $options['csrf_provider'],
-                $options['intention'] ?: $builder->getName()
+                $options['intention'] ?: ($builder->getName() ?: get_class($builder->getType()->getInnerType()))
             ))
         ;
     }
@@ -68,7 +68,8 @@ public function finishView(FormView $view, FormInterface $form, array $options)
     {
         if ($options['csrf_protection'] && !$view->parent && $options['compound']) {
             $factory = $form->getConfig()->getAttribute('csrf_factory');
-            $data = $options['csrf_provider']->generateCsrfToken($options['intention'] ?: $form->getName());
+            $intention = $options['intention'] ?: ($form->getName() ?: get_class($form->getConfig()->getType()->getInnerType()));
+            $data = $options['csrf_provider']->generateCsrfToken($intention);
 
             $csrfForm = $factory->createNamed($options['csrf_field_name'], 'hidden', $data, array(
                 'mapped' => false,
diff --git a/src/Symfony/Component/Form/Tests/Extension/Csrf/Type/FormTypeCsrfExtensionTest.php b/src/Symfony/Component/Form/Tests/Extension/Csrf/Type/FormTypeCsrfExtensionTest.php
@@ -147,6 +147,24 @@ public function testGenerateCsrfTokenUsesFormNameAsIntentionByDefault()
         $this->assertEquals('token', $view['csrf']->vars['value']);
     }
 
+    public function testGenerateCsrfTokenUsesTypeClassAsIntentionIfEmptyFormName()
+    {
+        $this->csrfProvider->expects($this->once())
+            ->method('generateCsrfToken')
+            ->with('Symfony\Component\Form\Extension\Core\Type\FormType')
+            ->will($this->returnValue('token'));
+
+        $view = $this->factory
+            ->createNamed('', 'form', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_provider' => $this->csrfProvider,
+                'compound' => true,
+            ))
+            ->createView();
+
+        $this->assertEquals('token', $view['csrf']->vars['value']);
+    }
+
     public function provideBoolean()
     {
         return array(
@@ -218,6 +236,37 @@ public function testValidateTokenOnBindIfRootAndCompoundUsesFormNameAsIntentionB
         $this->assertSame($valid, $form->isValid());
     }
 
+    /**
+     * @dataProvider provideBoolean
+     */
+    public function testValidateTokenOnBindIfRootAndCompoundUsesTypeClassAsIntentionIfEmptyFormName($valid)
+    {
+        $this->csrfProvider->expects($this->once())
+            ->method('isCsrfTokenValid')
+            ->with('Symfony\Component\Form\Extension\Core\Type\FormType', 'token')
+            ->will($this->returnValue($valid));
+
+        $form = $this->factory
+            ->createNamedBuilder('', 'form', null, array(
+                'csrf_field_name' => 'csrf',
+                'csrf_provider' => $this->csrfProvider,
+                'compound' => true,
+            ))
+            ->add('child', 'text')
+            ->getForm();
+
+        $form->bind(array(
+            'child' => 'foobar',
+            'csrf' => 'token',
+        ));
+
+        // Remove token from data
+        $this->assertSame(array('child' => 'foobar'), $form->getData());
+
+        // Validate accordingly
+        $this->assertSame($valid, $form->isValid());
+    }
+
     public function testFailIfRootAndCompoundAndTokenMissing()
     {
         $this->csrfProvider->expects($this->never())

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)`
`52`	`52`	`->addEventSubscriber(new CsrfValidationListener(`
`53`	`53`	`$options['csrf_field_name'],`
`54`	`54`	`$options['csrf_provider'],`
`55`		`- $options['intention'] ?: $builder->getName()`
	`55`	`+ $options['intention'] ?: ($builder->getName() ?: get_class($builder->getType()->getInnerType()))`
`56`	`56`	`))`
`57`	`57`	`;`
`58`	`58`	`}`
`@@ -68,7 +68,8 @@ public function finishView(FormView $view, FormInterface $form, array $options)`
`68`	`68`	`{`
`69`	`69`	`if ($options['csrf_protection'] && !$view->parent && $options['compound']) {`
`70`	`70`	`$factory = $form->getConfig()->getAttribute('csrf_factory');`
`71`		`- $data = $options['csrf_provider']->generateCsrfToken($options['intention'] ?: $form->getName());`
	`71`	`+ $intention = $options['intention'] ?: ($form->getName() ?: get_class($form->getConfig()->getType()->getInnerType()));`
	`72`	`+ $data = $options['csrf_provider']->generateCsrfToken($intention);`
`72`	`73`
`73`	`74`	`$csrfForm = $factory->createNamed($options['csrf_field_name'], 'hidden', $data, array(`
`74`	`75`	`'mapped' => false,`