[Form] Simplified CSRF mechanism and removed "csrf" type

CSRF fields are now only added when the view is built. For this reason we already know if the form is the root form and avoid to create unnecessary CSRF fields for nested fields.
symfony · fabpot · Apr 18, 2012 · Apr 13, 2012 · Apr 13, 2012 · Apr 13, 2012
commit 2a49449862ab74fbd80126384daa1957abaf2e0c
diff --git a/CHANGELOG-2.1.md b/CHANGELOG-2.1.md
@@ -269,6 +269,7 @@ To get the diff between two versions, go to https://github.com/symfony/symfony/c
    don't receive an options array anymore.
  * Deprecated FormValidatorInterface and substituted its implementations
    by event subscribers
+ * simplified CSRF protection and removed the csrf type
 
 ### HttpFoundation
 

diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/form_csrf.xml b/src/Symfony/Bundle/FrameworkBundle/Resources/config/form_csrf.xml
@@ -14,12 +14,9 @@
             <argument>%kernel.secret%</argument>
         </service>
 
-        <service id="form.type.csrf" class="Symfony\Component\Form\Extension\Csrf\Type\CsrfType">
-            <tag name="form.type" alias="csrf" />
-            <argument type="service" id="form.csrf_provider" />
-        </service>
         <service id="form.type_extension.csrf" class="Symfony\Component\Form\Extension\Csrf\Type\FormTypeCsrfExtension">
             <tag name="form.type_extension" alias="form" />
+            <argument type="service" id="form.csrf_provider" />
             <argument>%form.type_extension.csrf.enabled%</argument>
             <argument>%form.type_extension.csrf.field_name%</argument>
         </service>

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
@@ -27,9 +27,9 @@ public function testCsrfProtection()
         $def = $container->getDefinition('form.type_extension.csrf');
 
         $this->assertTrue($container->getParameter('form.type_extension.csrf.enabled'));
-        $this->assertEquals('%form.type_extension.csrf.enabled%', $def->getArgument(0));
+        $this->assertEquals('%form.type_extension.csrf.enabled%', $def->getArgument(1));
         $this->assertEquals('_csrf', $container->getParameter('form.type_extension.csrf.field_name'));
-        $this->assertEquals('%form.type_extension.csrf.field_name%', $def->getArgument(1));
+        $this->assertEquals('%form.type_extension.csrf.field_name%', $def->getArgument(2));
         $this->assertEquals('s3cr3t', $container->getParameterBag()->resolveValue($container->findDefinition('form.csrf_provider')->getArgument(1)));
     }
 

diff --git a/src/Symfony/Component/Form/Extension/Csrf/CsrfExtension.php b/src/Symfony/Component/Form/Extension/Csrf/CsrfExtension.php
@@ -32,27 +32,13 @@ public function __construct(CsrfProviderInterface $csrfProvider)
         $this->csrfProvider = $csrfProvider;
     }
 
-    /**
-     * {@inheritDoc}
-     */
-    protected function loadTypes()
-    {
-        return array(
-            new Type\CsrfType($this->csrfProvider),
-        );
-    }
-
     /**
      * {@inheritDoc}
      */
     protected function loadTypeExtensions()
     {
         return array(
-            new Type\ChoiceTypeCsrfExtension(),
-            new Type\DateTypeCsrfExtension(),
-            new Type\FormTypeCsrfExtension(),
-            new Type\RepeatedTypeCsrfExtension(),
-            new Type\TimeTypeCsrfExtension(),
+            new Type\FormTypeCsrfExtension($this->csrfProvider),
         );
     }
 }
diff --git a/src/Symfony/Component/Form/Extension/Csrf/EventListener/CsrfValidationListener.php b/src/Symfony/Component/Form/Extension/Csrf/EventListener/CsrfValidationListener.php
@@ -14,14 +14,20 @@
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\Form\FormEvents;
 use Symfony\Component\Form\FormError;
-use Symfony\Component\Form\Event\DataEvent;
+use Symfony\Component\Form\Event\FilterDataEvent;
 use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface;
 
 /**
  * @author Bernhard Schussek <bschussek@gmail.com>
  */
 class CsrfValidationListener implements EventSubscriberInterface
 {
+    /**
+     * The name of the CSRF field
+     * @var string
+     */
+    private $fieldName;
+
     /**
      * The provider for generating and validating CSRF tokens
      * @var CsrfProviderInterface
@@ -45,24 +51,26 @@ static public function getSubscribedEvents()
         );
     }
 
-    public function __construct(CsrfProviderInterface $csrfProvider, $intention)
+    public function __construct($fieldName, CsrfProviderInterface $csrfProvider, $intention)
     {
+        $this->fieldName = $fieldName;
         $this->csrfProvider = $csrfProvider;
         $this->intention = $intention;
     }
 
-    public function onBindClientData(DataEvent $event)
+    public function onBindClientData(FilterDataEvent $event)
     {
         $form = $event->getForm();
         $data = $event->getData();
 
-        if ((!$form->hasParent() || $form->getParent()->isRoot())
-            && !$this->csrfProvider->isCsrfTokenValid($this->intention, $data)) {
-            $form->addError(new FormError('The CSRF token is invalid. Please try to resubmit the form'));
+        if ($form->isRoot() && $form->hasChildren() && isset($data[$this->fieldName])) {
+            if (!$this->csrfProvider->isCsrfTokenValid($this->intention, $data[$this->fieldName])) {
+                $form->addError(new FormError('The CSRF token is invalid. Please try to resubmit the form'));
+            }
 
-            // If the session timed out, the token is invalid now.
-            // Regenerate the token so that a resubmission is possible.
-            $event->setData($this->csrfProvider->generateCsrfToken($this->intention));
+            unset($data[$this->fieldName]);
         }
+
+        $event->setData($data);
     }
 }
diff --git a/src/Symfony/Component/Form/Extension/Csrf/EventListener/EnsureCsrfFieldListener.php b/src/Symfony/Component/Form/Extension/Csrf/EventListener/EnsureCsrfFieldListener.php
diff --git a/src/Symfony/Component/Form/Extension/Csrf/Type/ChoiceTypeCsrfExtension.php b/src/Symfony/Component/Form/Extension/Csrf/Type/ChoiceTypeCsrfExtension.php
diff --git a/src/Symfony/Component/Form/Extension/Csrf/Type/CsrfType.php b/src/Symfony/Component/Form/Extension/Csrf/Type/CsrfType.php
diff --git a/src/Symfony/Component/Form/Extension/Csrf/Type/DateTypeCsrfExtension.php b/src/Symfony/Component/Form/Extension/Csrf/Type/DateTypeCsrfExtension.php