Skip to content

Commit 0fba13c

Browse files
lonnieezelllonnieezell
authored
Merge pull request #1633 from nowackipawel/patch-33
Uses csrf_field and form_hidden instead of inline-html in form_open
2 parents 8a0f7b4 + 0c6eeac commit 0fba13c

3 files changed

Lines changed: 30 additions & 15 deletions

File tree

‎system/Helpers/form_helper.php‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,12 @@ function form_open(string $action = '', $attributes = [], array $hidden = []): s
6565
$action = site_url($action);
6666
}
6767

68+
if(is_array($attributes) && array_key_exists('csrf_id', $attributes))
69+
{
70+
$csrfId = $attributes['csrf_id'];
71+
unset($attributes['csrf_id']);
72+
}
73+
6874
$attributes = stringify_attributes($attributes);
6975

7076
if (stripos($attributes, 'method=') === false)
@@ -82,17 +88,16 @@ function form_open(string $action = '', $attributes = [], array $hidden = []): s
8288
// Add CSRF field if enabled, but leave it out for GET requests and requests to external websites
8389
$before = Services::filters()->getFilters()['before'];
8490

85-
if ((in_array('csrf', $before) || array_key_exists('csrf', $before)) && strpos($action, base_url()) !== false && ! stripos($form, 'method="get"')
86-
)
91+
if ((in_array('csrf', $before) || array_key_exists('csrf', $before)) && strpos($action, base_url()) !== false && ! stripos($form, 'method="get"'))
8792
{
88-
$hidden[csrf_token()] = csrf_hash();
93+
$form .= csrf_field($csrfId ?? null);
8994
}
9095

9196
if (is_array($hidden))
9297
{
9398
foreach ($hidden as $name => $value)
9499
{
95-
$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value, 'html') . '" style="display: none;" />' . "\n";
100+
$form .= form_hidden($name, $value);
96101
}
97102
}
98103

@@ -167,7 +172,7 @@ function form_hidden($name, $value = '', bool $recursing = false): string
167172

168173
if (! is_array($value))
169174
{
170-
$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value, 'html') . "\" />\n";
175+
$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value, 'html') . "\" style=\"display:none;\" />\n";
171176
}
172177
else
173178
{

‎tests/system/Helpers/FormHelperTest.php‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ public function testFormOpenBasic()
3535
$Name = csrf_token();
3636
$expected = <<<EOH
3737
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" accept-charset="utf-8">
38-
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
38+
<input type="hidden" name="$Name" value="$Value" style="display:none;" />
3939
4040
EOH;
4141
}
@@ -73,7 +73,7 @@ public function testFormOpenWithoutAction()
7373
$Name = csrf_token();
7474
$expected = <<<EOH
7575
<form action="http://example.com/" name="form" id="form" method="POST" accept-charset="utf-8">
76-
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
76+
<input type="hidden" name="$Name" value="$Value" style="display:none;" />
7777
7878
EOH;
7979
}
@@ -110,7 +110,7 @@ public function testFormOpenWithoutMethod()
110110
$Name = csrf_token();
111111
$expected = <<<EOH
112112
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="post" accept-charset="utf-8">
113-
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
113+
<input type="hidden" name="$Name" value="$Value" style="display:none;" />
114114
115115
EOH;
116116
}
@@ -147,16 +147,17 @@ public function testFormOpenWithHidden()
147147
$Name = csrf_token();
148148
$expected = <<<EOH
149149
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" accept-charset="utf-8">
150-
<input type="hidden" name="foo" value="bar" style="display: none;" />
151-
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
150+
<input type="hidden" name="foo" value="bar" style="display:none;" />
151+
<input type="hidden" name="$Name" value="$Value" style="display:none;" />
152152
153153
EOH;
154154
}
155155
else
156156
{
157157
$expected = <<<EOH
158158
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" accept-charset="utf-8">
159-
<input type="hidden" name="foo" value="bar" style="display: none;" />
159+
160+
<input type="hidden" name="foo" value="bar" style="display:none;" />
160161
161162
EOH;
162163
}
@@ -225,7 +226,7 @@ public function testFormOpenMultipart()
225226
$Name = csrf_token();
226227
$expected = <<<EOH
227228
<form action="http://example.com/index.php/foo/bar" name="form" id="form" method="POST" enctype="multipart&#x2F;form-data" accept-charset="utf-8">
228-
<input type="hidden" name="$Name" value="$Value" style="display: none;" />
229+
<input type="hidden" name="$Name" value="$Value" style="display:none;" />
229230
230231
EOH;
231232
}
@@ -253,7 +254,7 @@ public function testFormHidden()
253254
{
254255
$expected = <<<EOH
255256
256-
<input type="hidden" name="username" value="johndoe" />\n
257+
<input type="hidden" name="username" value="johndoe" style="display:none;" />\n
257258
EOH;
258259
$this->assertEquals($expected, form_hidden('username', 'johndoe'));
259260
}
@@ -266,7 +267,7 @@ public function testFormHiddenArrayInput()
266267
];
267268
$expected = <<<EOH
268269
269-
<input type="hidden" name="foo" value="bar" />
270+
<input type="hidden" name="foo" value="bar" style="display:none;" />
270271
271272
EOH;
272273
$this->assertEquals($expected, form_hidden($data, null));
@@ -280,7 +281,7 @@ public function testFormHiddenArrayValues()
280281
];
281282
$expected = <<<EOH
282283
283-
<input type="hidden" name="name[foo]" value="bar" />
284+
<input type="hidden" name="name[foo]" value="bar" style="display:none;" />
284285
285286
EOH;
286287
$this->assertEquals($expected, form_hidden('name', $data));

‎user_guide_src/source/helpers/form_helper.rst‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,15 @@ The following functions are available:
9090
The above examples would create a form similar to this::
9191

9292
<form method="post" accept-charset="utf-8" action="http://example.com/index.php/email/send" class="email" id="myform">
93+
94+
If CSRF filter is turned on `form_open()` will generate CSRF field at the beginning of the form. You can specify ID of this field by passing csrf_id as one of the $attribute array:
95+
96+
form_open('/u/sign-up', ['csrf_id' => 'my-id']);
97+
98+
will return:
99+
100+
<form action="/u/sign-up" method="post" accept-charset="utf-8">
101+
<input type="hidden" id="my-id" name="csrf_field" value="964ede6e0ae8a680f7b8eab69136717d" />
93102

94103
**Adding Hidden Input Fields**
95104

0 commit comments

Comments
 (0)