adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2025-01-18 18:46:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix FormHelper::postLink() not working when SecurityComponent is enabled.

Browse source 
The action attribute value was not being included in the generated hash,
so postLink() forms never worked properly.

Fixes #3418
This commit is contained in:
mark_story 2014-04-29 11:23:52 -04:00
parent 1a39917e76
commit e1057e3e6b
2 changed files with 36 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
lib/Cake/Test/Case/View/Helper/FormHelperTest.php
View file

@ -7616,6 +7616,40 @@ class FormHelperTest extends CakeTestCase {
));
}
/**
* Test that security hashes for postLink include the url.
*
* @return void
*/
public function testPostLinkSecurityHash() {
$hash = Security::hash(
'/posts/delete/1' .
serialize(array()) .
'' .
Configure::read('Security.salt')
);
$hash .= '%3A';
$this->Form->request->params['_Token']['key'] = 'test';
$result = $this->Form->postLink('Delete', '/posts/delete/1');
$this->assertTags($result, array(
'form' => array(
'method' => 'post', 'action' => '/posts/delete/1',
'name', 'id', 'style' => 'display:none;'
),
array('input' => array('type' => 'hidden', 'name' => '_method', 'value' => 'POST')),
array('input' => array('type' => 'hidden', 'name' => 'data[_Token][key]', 'value' => 'test', 'id')),
'div' => array('style' => 'display:none;'),
array('input' => array('type' => 'hidden', 'name' => 'data[_Token][fields]', 'value' => $hash, 'id')),
array('input' => array('type' => 'hidden', 'name' => 'data[_Token][unlocked]', 'value' => '', 'id')),
'/div',
'/form',
'a' => array('href' => '#', 'onclick' => 'preg:/document\.post_\w+\.submit\(\); event\.returnValue = false; return false;/'),
'Delete',
'/a'
));
}
/**
* Test using postLink with N dimensional data.
*

2
lib/Cake/View/Helper/FormHelper.php
View file

@ -1790,6 +1790,8 @@ class FormHelper extends AppHelper {
unset($options['target']);
}
$this->_lastAction = $formUrl;
$out = $this->Html->useTag('form', $formUrl, $formOptions);
$out .= $this->Html->useTag('hidden', '_method', array(
'value' => $requestMethod