Refactoring FormHelper token generation

git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@4974 3807eeeb-6ff5-0310-8944-8be069107fe0

cake/libs/controller/components/security.php

@@ -73,6 +73,15 @@ class SecurityComponent extends Object {
  * @see SecurityComponent::requireAuth()
  */
 	var $requireAuth = array();
+/**
+ * Sets the window of time after which authentication keys expire.  If true, authentication keys
+ * expire on every request.  If a string, specifies a relative time frame, i.e. "+1 hour"
+ *
+ * @var mixed
+ * @access public
+ * @see SecurityComponent::requireAuth()
+ */
+	var $expires = true;
 /**
  * List of actions that require an HTTP-authenticated login (basic or digest)
  *
@@ -421,12 +430,12 @@ class SecurityComponent extends Object {
  */
 	function __validatePost(&$controller) {
 		if(!empty($controller->data)) {
-			if (!isset($controller->data['__Token'])) {
+			if (!isset($controller->data['_Token'])) {
 				if(!$this->blackHole($controller, 'auth')) {
 					return null;
 				}
 			}
-			$token = $controller->data['__Token']['key'];
+			$token = $controller->data['_Token']['key'];
 
 			if($this->Session->check('_Token')) {
 				$tData = unserialize($this->Session->read('_Token'));
@@ -438,17 +447,17 @@ class SecurityComponent extends Object {
 				}
 			}
 
-			if(!isset($controller->data['__Token']['fields'])) {
+			if(!isset($controller->data['_Token']['fields'])) {
 				if(!$this->blackHole($controller, 'auth')) {
 					return null;
 				}
 			}
-			$fields = $controller->data['__Token']['fields'];
+			$fields = $controller->data['_Token']['fields'];
 			$check = $controller->data;
-			unset($check['__Token']['fields']);
+			unset($check['_Token']['fields']);
 
 			foreach($check as $key => $value) {
-				if($key === '__Token') {
+				if($key === '_Token') {
 					$field[$key] = $value;
 					continue;
 				}

cake/libs/view/helper.php

@@ -328,11 +328,11 @@ class Helper extends Overloadable {
 /**
  * Sets this helper's model and field properties to the slash-separated value-pair in $tagValue.
  *
- * @param string $tagValue A field name, like "Modelname.fieldname", "Modelname/fieldname" is deprecated
+ * @param string $field A field name, like "Modelname.fieldname", "Modelname/fieldname" is deprecated
  */
-	function setFormTag($tagValue) {
+	function setFormTag($field) {
 		$view =& ClassRegistry::getObject('view');
-		$parts = preg_split('/\/|\./', $tagValue);
+		$parts = preg_split('/\/|\./', $field);
 
 		if (count($parts) == 1) {
 			$view->field = $parts[0];
@@ -347,6 +347,15 @@ class Helper extends Overloadable {
 			$view->modelId = $parts[1];
 			$view->field   = $parts[2];
 		}
+		
+	}
+/**
+ * Returns the fully-qualified field name of the current field in the rendering context.
+ *
+ * @return string
+ */
+	function getFormTag() {
+		return 'blah';
 	}
 /**
  * Gets the currently-used model of the rendering context.
@@ -375,6 +384,15 @@ class Helper extends Overloadable {
 		$view =& ClassRegistry::getObject('view');
 		return $view->field;
 	}
+/**
+ * Gets the currently-used model field of the rendering context.
+ *
+ * @return string
+ */
+	function fieldSuffix() {
+		$view =& ClassRegistry::getObject('view');
+		return $view->fieldSuffix;
+	}
 /**
  * Returns false if given FORM field has no errors. Otherwise it returns the constant set in the array Model->validationErrors.
  *
@@ -412,7 +430,7 @@ class Helper extends Overloadable {
  *
  * @param array $options
  * @param string $key
- * @return array
+ * @return mixed
  */
 	function __name($options = array(), $field = null, $key = 'name') {
 		if ($options === null) {
@@ -431,14 +449,13 @@ class Helper extends Overloadable {
 		}
 
 		switch($field) {
-			case 'method':
 			case '_method':
 				$name = $field;
 			break;
 			default:
-				$name = array_filter(array($this->model(), $this->field(), $this->modelID()));
+				$name = Set::filter(array($this->model(), $this->field())); //, $this->modelID()));
 				if ($this->modelID() === 0) {
-					$name[] = $this->modelID();
+					//$name[] = $this->modelID();
 				}
 				$name = 'data[' . join('][', $name) . ']';
 			break;
@@ -498,25 +515,6 @@ class Helper extends Overloadable {
 			return $result;
 		}
 	}
-/**
- * Sets the defaults for an input tag
- *
- * @param array $options
- * @param string $key
- * @return array
- */
-	function __initInputField($field, $options = array()) {
-		$this->setFormTag($field);
-		$options = (array)$options;
-		$options = $this->__name($options);
-		$options = $this->__value($options);
-		$options = $this->domId($options);
-		if ($this->tagIsInvalid()) {
-			$options = $this->addClass($options, 'form-error');
-		}
-		unset($options['name']); // Temporary
-		return $options;
-	}
 /**
  * Adds the given class to the element options
  *

cake/libs/view/helpers/form.php

@@ -58,19 +58,38 @@ class FormHelper extends AppHelper {
 
 	var $helpers = array('Html');
 
-	/**
+/**
-	 * holds the fields array('field_name'=>'type'), sizes array('field_name'=>'size'),
+ * Holds the fields array('field_name'=>'type'), sizes array('field_name'=>'size'),
  * primaryKey and validates array('field_name')
  *
+ * @var array
  * @access public
  */
-	var $fieldset = array('fields'=>array(), 'sizes'=>array(), 'key'=>'id', 'validates'=>array());
+	var $fieldset = array('fields' => array(), 'sizes' => array(), 'key' => 'id', 'validates' => array());
-
+/**
+ * Local cache of default generated options for date/time input fields
+ *
+ * @var array
+ * @access private
+ */
 	var $__options = array('day' => array(), 'minute' => array(), 'hour' => array(),
 									'month' => array(), 'year' => array(), 'meridian' => array());
-
 	var $fields = array();
 
+/**
+ * List of input fields generated in the current form (between create() and end()).
+ *
+ * @var array
+ * @access public
+ */
+	var $inputFields = array();
+/**
+ * Maintains the attributes of the current form (between create() and end()).
+ *
+ * @var array
+ * @access public
+ */
+	var $current = array();
 /**
  * Returns an HTML FORM element.
  *
@@ -81,6 +100,8 @@ class FormHelper extends AppHelper {
  */
 	function create($model = null, $options = array()) {
 		$defaultModel = null;
+		$this->inputFields = array();
+
 		$data = array('fields' => '','key' => '', 'validates' => '');
 		$view =& ClassRegistry::getObject('view');
 
@@ -143,7 +164,7 @@ class FormHelper extends AppHelper {
 
 		if (empty($options['url']) || is_array($options['url'])) {
 			$options = (array)$options;
-			if(!empty($this->plugin)) {
+			if (!empty($this->plugin)) {
 				$controller = $this->plugin;
 			} elseif (!empty($model) && $model != $defaultModel) {
 				$controller = Inflector::underscore(Inflector::pluralize($model));
@@ -166,6 +187,7 @@ class FormHelper extends AppHelper {
 		} elseif (is_string($options['url'])) {
 			$options['action'] = $options['url'];
 		}
+		$this->current = $options;
 		unset($options['url']);
 
 		switch (low($options['type'])) {
@@ -183,6 +205,7 @@ class FormHelper extends AppHelper {
 				$htmlAttributes['method'] = 'post';
 			break;
 		}
+		$append .= $this->authToken();
 
 		$htmlAttributes['action'] = $this->url($options['action']);
 		unset($options['type'], $options['action']);
@@ -197,12 +220,6 @@ class FormHelper extends AppHelper {
 		unset($options['default']);
 		$htmlAttributes = am($options, $htmlAttributes);
 
-		if (isset($this->params['_Token']) && !empty($this->params['_Token'])) {
-			$append .= '<p style="display: inline; margin: 0px; padding: 0px;">';
-			$append .= $this->hidden('_Token/key', array('value' => $this->params['_Token']['key'], 'id' => $options['id'] . 'Token' . mt_rand()));
-			$append .= '</p>';
-		}
-
 		$this->setFormTag($model . '.');
 		return $this->output(sprintf($this->Html->tags['form'], $this->Html->parseHtmlOptions($htmlAttributes, null, ''))) . $append;
 	}
@@ -212,17 +229,17 @@ class FormHelper extends AppHelper {
  * @access public
  * @return string A closing FORM tag.
  */
-	function end($options = null) {
+	function end($options = array()) {
-		if (!empty($this->params['models'])) {
+		$submitOptions = $submit = false;
-			$models = $this->params['models'][0];
-		}
 
-		$submitOptions = true;
+		if (!is_array($options)) {
-		if(!is_array($options)) {
 			$submitOptions = $options;
-		} else if(isset($options['submit'])) {
+		} elseif (isset($options['submit'])) {
 			$submitOptions = $options['submit'];
 			unset($options['submit']);
+			if (!is_array($submitOptions)) {
+				$submitOptions = array('label' => $submitOptions);
+			}
 
 			if(isset($submitOptions['label'])) {
 				$submit = $submitOptions['label'];
@@ -230,9 +247,9 @@ class FormHelper extends AppHelper {
 			}
 		}
 
-		if($submitOptions === true) {
+		if ($submitOptions === true) {
 			$submit = 'Submit';
-		} else if(is_string($submitOptions)) {
+		} elseif (is_string($submitOptions)) {
 			$submit = $submitOptions;
 		}
 
@@ -241,18 +258,47 @@ class FormHelper extends AppHelper {
 		}
 		$out = null;
 
-		if(isset($submit)) {
+		if($submit !== false) {
 			$out .= $this->submit($submit, $submitOptions);
 		}
-		$out .= $this->Html->tags['formend'];
+		$out .= $this->output($this->Html->tags['formend']);
-		return $this->output($out);
+
+		$this->inputFields = $this->current = array();
+		return $out;
 	}
+/**
+ * Creates a serialized hash of the list of fields used in this form
+ *
+ * @param array $options
+ * @param string $key
+ * @return array
+ */
 	function secure($fields) {
 		$append = '<p style="display: inline; margin: 0px; padding: 0px;">';
 		$append .= $this->hidden('_Token/fields', array('value' => urlencode(Security::hash(serialize($fields) . CAKE_SESSION_STRING)), 'id' => 'TokenFields' . mt_rand()));
 		$append .= '</p>';
 		return $append;
 	}
+/**
+ * Sets the defaults for an input tag
+ *
+ * @param array $options
+ * @param string $key
+ * @return array
+ */
+	function __initInputField($field, $options = array()) {
+		$this->setFormTag($field);
+		$options = (array)$options;
+		$options = $this->__name($options);
+		$options = $this->__value($options);
+		$options = $this->domId($options);
+		if ($this->tagIsInvalid()) {
+			$options = $this->addClass($options, 'form-error');
+		}
+		$this->inputFields[$this->getFormTag()] = $options;
+		unset($options['name']); // Temporary
+		return $options;
+	}
 /**
  * Returns true if there is an error for the given field, otherwise false
  *
@@ -325,6 +371,19 @@ class FormHelper extends AppHelper {
 		}
 		return $this->output(sprintf($this->Html->tags['label'], $this->domId($tagName), $this->_parseAttributes($attributes), $text));
 	}
+/**
+ * Captures field names to be stored in the list of current fields
+ *
+ * @access public
+ * @param array $options
+ * @param string $key
+ * @return mixed
+ */
+	function __name($options = array(), $field = null, $key = 'name') {
+		$out = parent::__name($options, $field, $key);
+		$this->inputFields[] = implode('.', Set::filter(array($this->model(), $this->field(), $this->modelID())));
+		return $out;
+	}
 /**
  * Will display all the fields passed in an array expects tagName as an array key
  * replaces generateFields
@@ -332,7 +391,7 @@ class FormHelper extends AppHelper {
  * @access public
  * @param array $fields works well with Controller::generateFields() or on its own;
  * @param array $blacklist a simple array of fields to skip
- * @return output
+ * @return string
  */
 	function inputs($fields = null, $blacklist = null) {
 		if(!is_array($fields)) {
@@ -603,9 +662,6 @@ class FormHelper extends AppHelper {
 		$options = $this->__initInputField($fieldName, $options);
 		$model = $this->model();
 		unset($options['class']);
-		if(isset($this->params['_Token']) && !empty($this->params['_Token'])) {
-			$model = '_' . $model;
-		}
 		$this->fields[$model][$this->field()] = $options['value'];
 
 		if (in_array($fieldName, array('_method', '_fields'))) {
@@ -613,6 +669,22 @@ class FormHelper extends AppHelper {
 		}
 		return $this->output(sprintf($this->Html->tags['hidden'], $model, $this->field(), $this->_parseAttributes($options, null, ' ', ' ')));
 	}
+/**
+ * Creates a token field used for authentication with SecurityComponent::requireAuth()
+ *
+ * @return string
+ * @access public
+ * @see SecurityComponent::requireAuth
+ */
+	function authToken($id = null) {
+		if (!isset($this->params['_Token']) || empty($this->params['_Token']) || empty($this->current) || in_array('_Token.key', $this->inputFields)) {
+			return false;
+		}
+		if (empty($id) && $id != false) {
+			$id = $this->current['id'] . 'Token' . mt_rand();
+		}
+		return $this->hidden('_Token.key', array('value' => $this->params['_Token']['key'], 'id' => $id));
+	}
 /**
  * Creates file input widget.
  *
@@ -1111,7 +1183,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateInputDiv($tagName, $prompt, $required = false, $errorMsg = null, $size = 20, $htmlOptions = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() or FormHelper::text() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() or FormHelper::text() instead', true), E_USER_WARNING);
 		$htmlOptions['id'] = strtolower(str_replace('/', '_', $tagName));
 		$htmlAttributes = $htmlOptions;
 		$htmlAttributes['size'] = $size;
@@ -1135,7 +1207,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateCheckboxDiv($tagName, $prompt, $required = false, $errorMsg = null, $htmlOptions = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() or FormHelper::checkbox() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() or FormHelper::checkbox() instead', true), E_USER_WARNING);
 		$htmlOptions['class'] = "inputCheckbox";
 		$htmlOptions['id'] = strtolower(str_replace('/', '_', $tagName));
 		$str = $this->Html->checkbox($tagName, null, $htmlOptions);
@@ -1158,7 +1230,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateDate($tagName, $prompt, $required = false, $errorMsg = null, $size = 20, $htmlOptions = null, $selected = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() instead', true), E_USER_WARNING);
 		$htmlOptions['id']=strtolower(str_replace('/', '_', $tagName));
 		$str = $this->dateTime($tagName, 'MDY', 'NONE', $selected, $htmlOptions);
 		$strLabel = $this->label($tagName, $prompt);
@@ -1181,7 +1253,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateTime($tagName, $prompt, $required = false, $errorMsg = null, $size = 20, $htmlOptions = null, $selected = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() instead', true), E_USER_WARNING);
 		$str = $this->dateTime($tagName, 'NONE', '24', $selected, $htmlOptions);
 		$strLabel = $this->label($tagName, $prompt);
 		$divClass = "optional";
@@ -1203,7 +1275,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateDateTime($tagName, $prompt, $required = false, $errorMsg = null, $size = 20, $htmlOptions = null, $selected = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() instead', true), E_USER_WARNING);
 		$htmlOptions['id']=strtolower(str_replace('/', '_', $tagName));
 		$str = $this->dateTime($tagName, 'MDY', '12', $selected, $htmlOptions, null, false);
 		$strLabel = $this->label($tagName, $prompt);
@@ -1226,7 +1298,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateAreaDiv($tagName, $prompt, $required = false, $errorMsg = null, $cols = 60, $rows = 10, $htmlOptions = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() instead', true), E_USER_WARNING);
 		$htmlOptions['id'] = strtolower(str_replace('/', '_', $tagName));
 		$htmlAttributes = $htmlOptions;
 		$htmlAttributes['cols'] = $cols;
@@ -1252,7 +1324,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateSelectDiv($tagName, $prompt, $options, $selected = null, $selectAttr = null, $optionAttr = null, $required = false, $errorMsg = null) {
-		trigger_error(__('Deprecated: Use FormHelper::input() or FormHelper::select() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() or FormHelper::select() instead', true), E_USER_WARNING);
 		$selectAttr['id'] = strtolower(str_replace('/', '_', $tagName));
 		$str = $this->Html->selectTag($tagName, $options, $selected, $selectAttr, $optionAttr);
 		$strLabel = $this->label($tagName, $prompt);
@@ -1275,7 +1347,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::input()
  */
 	function generateSubmitDiv($displayText, $htmlOptions = null) {
-		trigger_error(__('Deprecated: Use FormHelper::submit() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::submit() instead', true), E_USER_WARNING);
 		return $this->divTag('submit', $this->Html->submit($displayText, $htmlOptions));
 	}
 /**
@@ -1283,7 +1355,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::inputs()
  */
 	function generateFields($fields, $readOnly = false) {
-		trigger_error(__('Deprecated: Use FormHelper::input() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::input() instead', true), E_USER_WARNING);
 		$strFormFields = '';
 
 		foreach($fields as $field) {
@@ -1400,7 +1472,7 @@ class FormHelper extends AppHelper {
  * @see FormHelper::label()
  */
 	function labelTag($tagName, $text) {
-		trigger_error(__('Deprecated: Use FormHelper::label() instead'), E_USER_WARNING);
+		trigger_error(__('Deprecated: Use FormHelper::label() instead', true), E_USER_WARNING);
 		return sprintf($this->Html->tags['label'], Inflector::camelize(r('/', '_', $tagName)), $text);
 	}
 /**
@@ -1408,7 +1480,7 @@ class FormHelper extends AppHelper {
  * @see HtmlHelper::div
  */
 	function divTag($class, $text) {
-		//trigger_error(__('(FormHelper::divTag) Deprecated: Use HtmlHelper::div instead'), E_USER_WARNING);
+		trigger_error(__('(FormHelper::divTag) Deprecated: Use HtmlHelper::div instead', true), E_USER_WARNING);
 		return sprintf(TAG_DIV, $class, $text);
 	}
 /**
@@ -1416,7 +1488,7 @@ class FormHelper extends AppHelper {
  * @see HtmlHelper::para
  */
 	function pTag($class, $text) {
-		//trigger_error(__('(FormHelper::pTag) Deprecated: Use HtmlHelper::para instead'), E_USER_WARNING);
+		trigger_error(__('(FormHelper::pTag) Deprecated: Use HtmlHelper::para instead', true), E_USER_WARNING);
 		return sprintf(TAG_P_CLASS, $class, $text);
 	}
 }

cake/tests/cases/libs/view/helpers/form.test.php

@@ -93,7 +93,7 @@
 		}
 	}
 
-	/**
+/**
  * Short description for class.
  *
  * @package		cake.tests
@@ -635,12 +635,23 @@ class FormHelperTest extends CakeTestCase {
 		$this->assertPattern('/^<form[^<>]+action="\/contacts\/edit\/1"[^<>]*>/', $result);
 		$this->assertNoPattern('/^<form[^<>]+[^id|method|action]=[^<>]*>/', $result);
 
+		$this->Form->params['_Token']['key'] = 'blah';
+		$result = $this->Form->create('Contact');
+		$this->assertPattern('/<input[^<>]+type="hidden"[^<>]+>/', $result);
+		$this->assertPattern('/<input[^<>]+name="data\[_Token\]\[key\]"[^<>]*>/', $result);
+
 		$result = $this->Form->create('Contact', array('id' => 'TestId'));
 		$this->assertPattern('/id="TestId"/', $result);
 	}
 
 	function testFormEnd() {
 		$this->assertEqual($this->Form->end(), '</form>');
+		$result = $this->Form->end(true);
+		$this->assertPattern('/^<div\s+class="submit"><input\s+type="submit"\s+value="Submit"\s+\/><\/div><\/form>$/', $result);
+		$result = $this->Form->end('Send');
+		$this->assertPattern('/^<div\s+class="submit"><input\s+type="submit"\s+value="Send"\s+\/><\/div><\/form>$/', $result);
+		$result = $this->Form->end(array('submit' => 'Super'));
+		$this->assertPattern('/^<div\s+class="submit"><input\s+type="submit"\s+value="Super"\s+\/><\/div><\/form>$/', $result);
 	}
 
 	function tearDown() {