adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 11:28:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

changed FormHelper::secure() and FormHelper::end() to support attributes in the hidden CSRF-protection tags that are being generated for SecurityComponent to allow specification of additional html attributes like HTML5s "form" attribute. This allows separation of Form instantiation/controls and form data - for instance within html tables

Browse source 
improved tests for testing against additional attributes for Form::secure()

improved tests for testing against additional attributes for Form::end()

removed array cast, fixed test

fixed docblock format

format

Fixed a bug, this won't work as some forms are just empty
This commit is contained in:
Jonas 2013-12-30 16:28:10 +01:00 committed by mark_story
parent a965903777
commit b32deed4aa
2 changed files with 44 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
lib/Cake/Test/Case/View/Helper/FormHelperTest.php Normal file → Executable file
View file

@ -689,9 +689,10 @@ class FormHelperTest extends CakeTestCase {
public function testFormSecurityFields() { public function testFormSecurityFields() {
$key = 'testKey'; $key = 'testKey';
$fields = array('Model.password', 'Model.username', 'Model.valid' => '0'); $fields = array('Model.password', 'Model.username', 'Model.valid' => '0');
$secureAttributes = array('form' => 'MyTestForm');
$this->Form->request['_Token'] = array('key' => $key); $this->Form->request['_Token'] = array('key' => $key);
$result = $this->Form->secure($fields); $result = $this->Form->secure($fields, $secureAttributes);
$hash = Security::hash(serialize($fields) . Configure::read('Security.salt')); $hash = Security::hash(serialize($fields) . Configure::read('Security.salt'));
$hash .= ':' . 'Model.valid'; $hash .= ':' . 'Model.valid';
@ -701,11 +702,13 @@ class FormHelperTest extends CakeTestCase {
'div' => array('style' => 'display:none;'), 'div' => array('style' => 'display:none;'),
array('input' => array( array('input' => array(
'type' => 'hidden', 'name' => 'data[_Token][fields]', 'type' => 'hidden', 'name' => 'data[_Token][fields]',
'value' => $hash, 'id' => 'preg:/TokenFields\d+/' 'value' => $hash, 'id' => 'preg:/TokenFields\d+/',
'form' => 'MyTestForm',
)), )),
array('input' => array( array('input' => array(
'type' => 'hidden', 'name' => 'data[_Token][unlocked]', 'type' => 'hidden', 'name' => 'data[_Token][unlocked]',
'value' => '', 'id' => 'preg:/TokenUnlocked\d+/' 'value' => '', 'id' => 'preg:/TokenUnlocked\d+/',
'form' => 'MyTestForm',
)), )),
'/div' '/div'
); );
@ -713,16 +716,18 @@ class FormHelperTest extends CakeTestCase {
$path = CAKE . 'Test' . DS . 'test_app' . DS . 'Config' . DS; $path = CAKE . 'Test' . DS . 'test_app' . DS . 'Config' . DS;
$this->Form->Html->loadConfig('htmlhelper_tags', $path); $this->Form->Html->loadConfig('htmlhelper_tags', $path);
$result = $this->Form->secure($fields); $result = $this->Form->secure($fields, $secureAttributes);
$expected = array( $expected = array(
'div' => array('class' => 'hidden'), 'div' => array('class' => 'hidden'),
array('input' => array( array('input' => array(
'type' => 'hidden', 'name' => 'data[_Token][fields]', 'type' => 'hidden', 'name' => 'data[_Token][fields]',
'value' => $hash, 'id' => 'preg:/TokenFields\d+/' 'value' => $hash, 'id' => 'preg:/TokenFields\d+/',
'form' => 'MyTestForm',
)), )),
array('input' => array( array('input' => array(
'type' => 'hidden', 'name' => 'data[_Token][unlocked]', 'type' => 'hidden', 'name' => 'data[_Token][unlocked]',
'value' => '', 'id' => 'preg:/TokenUnlocked\d+/' 'value' => '', 'id' => 'preg:/TokenUnlocked\d+/',
'form' => 'MyTestForm',
)), )),
'/div' '/div'
); );
@ -9047,6 +9052,15 @@ class FormHelperTest extends CakeTestCase {
public function testFormEnd() { public function testFormEnd() {
$this->assertEquals('</form>', $this->Form->end()); $this->assertEquals('</form>', $this->Form->end());
$result = $this->Form->end('', array('form' => 'MyTestFormWithSupportForSecurityComponent'));
$expected = array(
'div' => array('class' => 'submit'),
'input' => array('type' => 'submit', 'value' => '', 'form' => 'MyTestFormWithSupportForSecurityComponent'),
'/div',
'/form'
);
$this->assertTags($result, $expected);
$result = $this->Form->end(''); $result = $this->Form->end('');
$expected = array( $expected = array(
'div' => array('class' => 'submit'), 'div' => array('class' => 'submit'),

30
lib/Cake/View/Helper/FormHelper.php Normal file → Executable file
View file

@ -498,11 +498,16 @@ class FormHelper extends AppHelper {
* array('label' => 'save', 'name' => 'Whatever', 'div' => array('class' => 'good')); <div class="good"> value="save" name="Whatever" * array('label' => 'save', 'name' => 'Whatever', 'div' => array('class' => 'good')); <div class="good"> value="save" name="Whatever"
* }}} * }}}
* *
* If $secureAttributes is set, these html attributes will be merged into the hidden input tags generated for the
* Security Component. This is especially useful to set HTML5 attributes like 'form'
*
* @param string|array $options as a string will use $options as the value of button, * @param string|array $options as a string will use $options as the value of button,
* @param array $secureAttributes will be passed as html attributes into the hidden input elements generated for the
* Security Component.
* @return string a closing FORM tag optional submit button. * @return string a closing FORM tag optional submit button.
* @link http://book.cakephp.org/2.0/en/core-libraries/helpers/form.html#closing-the-form * @link http://book.cakephp.org/2.0/en/core-libraries/helpers/form.html#closing-the-form
*/ */
public function end($options = null) { public function end($options = null, $secureAttributes = array()) {
$out = null; $out = null;
$submit = null; $submit = null;
@ -524,7 +529,7 @@ class FormHelper extends AppHelper {
isset($this->request['_Token']) && isset($this->request['_Token']) &&
!empty($this->request['_Token']) !empty($this->request['_Token'])
) { ) {
$out .= $this->secure($this->fields); $out .= $this->secure($this->fields, $secureAttributes);
$this->fields = array(); $this->fields = array();
} }
$this->setEntity(null); $this->setEntity(null);
@ -538,11 +543,18 @@ class FormHelper extends AppHelper {
/** /**
* Generates a hidden field with a security hash based on the fields used in the form. * Generates a hidden field with a security hash based on the fields used in the form.
* *
* @param array $fields The list of fields to use when generating the hash * If $secureAttributes is set, these html attributes will be merged into the hidden input tags generated for the
* Security Component. This is especially useful to set HTML5 attributes like 'form'.
*
* @param array|null $fields If set specifies the list of fields to use when generating the hash, else $this->fields
* is being used.
* @param array $secureAttributes will be passed as html attributes into the hidden input elements generated for the
* Security Component.
* @return string A hidden input field with a security hash * @return string A hidden input field with a security hash
* @link http://book.cakephp.org/2.0/en/core-libraries/helpers/form.html#FormHelper::secure * @link http://book.cakephp.org/2.0/en/core-libraries/helpers/form.html#FormHelper::secure
*/ */
public function secure($fields = array()) { public function secure($fields = array(), $secureAttributes = array()) {
if (!isset($this->request['_Token']) || empty($this->request['_Token'])) { if (!isset($this->request['_Token']) || empty($this->request['_Token'])) {
return; return;
} }
@ -565,14 +577,16 @@ class FormHelper extends AppHelper {
$unlocked = implode($unlockedFields, '|'); $unlocked = implode($unlockedFields, '|');
$fields = Security::hash(serialize($fields) . $unlocked . Configure::read('Security.salt'), 'sha1'); $fields = Security::hash(serialize($fields) . $unlocked . Configure::read('Security.salt'), 'sha1');
$out = $this->hidden('_Token.fields', array( $tokenFields = array_merge($secureAttributes, array(
'value' => urlencode($fields . ':' . $locked), 'value' => urlencode($fields . ':' . $locked),
'id' => 'TokenFields' . mt_rand() 'id' => 'TokenFields' . mt_rand(),
)); ));
$out .= $this->hidden('_Token.unlocked', array( $out = $this->hidden('_Token.fields', $tokenFields);
$tokenUnlocked = array_merge($secureAttributes, array(
'value' => urlencode($unlocked), 'value' => urlencode($unlocked),
'id' => 'TokenUnlocked' . mt_rand() 'id' => 'TokenUnlocked' . mt_rand(),
)); ));
$out .= $this->hidden('_Token.unlocked', $tokenUnlocked);
return $this->Html->useTag('hiddenblock', $out); return $this->Html->useTag('hiddenblock', $out);
} }